- 949
- 252
The Dutch Financial Crime Investigation Service (FIOD) reported the seizure of over 800 servers and the arrest of two individuals. The operation was part of an investigation into hosting infrastructure linked by authorities to cyberattacks, disinformation campaigns, and EU sanctions violations. According to media reports, the companies involved include Stark Industries, Mirhosting, WorkTitans, and possibly related services THE.Hosting, UFO.Hosting, GEO.Hosting, and others.
According to the FIOD, the operation began on May 18 and targeted data centers in Dronten and Schiphol-Rijk. Investigators also conducted searches in Enschede and Almere. As a result, a 57-year-old Amsterdam resident, the director of the hosting company, and a 39-year-old resident of The Hague, the head of the provider that provided network infrastructure to the former, were arrested.
Investigators report that the detainees "indirectly provided economic resources" to organizations sanctioned by the European Union. In a statement, the FIOD stated that the investigation is related to an unnamed hosting company founded on February 10, 2022. Investigators believe the company's infrastructure was used for "destabilizing activities against the EU," including cyberattacks and the spread of disinformation.
In May 2025, the EU added the company to its sanctions list , but FIOD claims that a significant portion of the infrastructure was subsequently transferred to a new Dutch company, which investigators believe was a front for sanctioned entities.
While FIOD has not officially disclosed the names of the companies or those detained, de Volkskrant published its own investigation, which suggests that the companies may be Stark Industries, WorkTitans, and Mirhosting. According to journalists, the infrastructure of these companies was allegedly used to transit traffic for the pro-Russian hacker group NoName057(16), known for its attacks on European organizations and government agencies.
The journalists claim that after sanctions were imposed on Stark Industries, some of the infrastructure and IP addresses were transferred to the Dutch company WorkTitans, which operated under the brand name THE.Hosting. Furthermore, the investigation links Mirhosting to server hosting and infrastructure connection to major European traffic exchange points.
Mirhosting representatives commented on the situation in an interview with de Volkskrant, stating that they did not intentionally support illegal activity and always responded to complaints upon receipt. WorkTitans did not respond to journalists' inquiries.
It's worth noting that following Operation FIOD, THE.Hosting, UFO.Hosting, and GEO.Hosting customers began experiencing widespread issues. As early as May 19, users began complaining about VPS unavailability, control panel and billing downtime, and a lack of support responses.
Later, the hosting providers' customers received notifications of a "large-scale technical incident." The message stated that infrastructure in the US, Germany, the Netherlands, and Austria was "completely lost and cannot be restored." Users were promised automatic provisioning of new servers in other locations and compensation. However, judging by posts on Habr and social media, some customers never received their new servers. Users also report data loss, slow support responses, and issues with refunds. @xakep.ru
According to the FIOD, the operation began on May 18 and targeted data centers in Dronten and Schiphol-Rijk. Investigators also conducted searches in Enschede and Almere. As a result, a 57-year-old Amsterdam resident, the director of the hosting company, and a 39-year-old resident of The Hague, the head of the provider that provided network infrastructure to the former, were arrested.
Investigators report that the detainees "indirectly provided economic resources" to organizations sanctioned by the European Union. In a statement, the FIOD stated that the investigation is related to an unnamed hosting company founded on February 10, 2022. Investigators believe the company's infrastructure was used for "destabilizing activities against the EU," including cyberattacks and the spread of disinformation.
In May 2025, the EU added the company to its sanctions list , but FIOD claims that a significant portion of the infrastructure was subsequently transferred to a new Dutch company, which investigators believe was a front for sanctioned entities.
While FIOD has not officially disclosed the names of the companies or those detained, de Volkskrant published its own investigation, which suggests that the companies may be Stark Industries, WorkTitans, and Mirhosting. According to journalists, the infrastructure of these companies was allegedly used to transit traffic for the pro-Russian hacker group NoName057(16), known for its attacks on European organizations and government agencies.
The journalists claim that after sanctions were imposed on Stark Industries, some of the infrastructure and IP addresses were transferred to the Dutch company WorkTitans, which operated under the brand name THE.Hosting. Furthermore, the investigation links Mirhosting to server hosting and infrastructure connection to major European traffic exchange points.
Mirhosting representatives commented on the situation in an interview with de Volkskrant, stating that they did not intentionally support illegal activity and always responded to complaints upon receipt. WorkTitans did not respond to journalists' inquiries.
It's worth noting that following Operation FIOD, THE.Hosting, UFO.Hosting, and GEO.Hosting customers began experiencing widespread issues. As early as May 19, users began complaining about VPS unavailability, control panel and billing downtime, and a lack of support responses.
Later, the hosting providers' customers received notifications of a "large-scale technical incident." The message stated that infrastructure in the US, Germany, the Netherlands, and Austria was "completely lost and cannot be restored." Users were promised automatic provisioning of new servers in other locations and compensation. However, judging by posts on Habr and social media, some customers never received their new servers. Users also report data loss, slow support responses, and issues with refunds. @xakep.ru