Authorities seize 800 servers used for cyberattacks and disinformation

Dutch authorities arrested two men and seized 800 servers linked to a hosting provider that investigators say supported Russian activities aimed at undermining democracy and security through cyberattacks, disinformation, and disruption of public and economic systems.

Servers seized by Dutch authorities (Source: FIOD)

The Dutch Fiscal Information and Investigation Service (FIOD) arrested a 57-year-old man from Amsterdam and a 39-year-old man from The Hague on suspicion of violating Dutch sanctions laws. The two men allegedly made economic resources available to entities placed under European Union sanctions.

The investigation centers on a web hosting company established on February 10, 2022, just two weeks before Russia launched its invasion of Ukraine.

According to FIOD, the company later became involved in activities targeting the European Union, including cyberattacks, interference operations, and disinformation campaigns. The agency said the company was “used, among other things, to facilitate destabilizing activities directed against the European Union.”

“On May 20, 2025, this web hosting company was placed on the sanctions list by the European Union. Around the same period, a significant part of the technical infrastructure of the sanctioned company was transferred to a newly established Dutch company,” FIOD said.

FIOD believes the newly established firm served as a front for sanctioned entities, with the 57-year-old suspect acting as its director and indirect sole shareholder.

A second Dutch firm allegedly helped keep the infrastructure online by providing internet connectivity for the servers. The 39-year-old suspect was identified as the director and sole shareholder of that firm.

Authorities searched three business locations in Enschede and Almere, along with two data centers in Dronten and Schiphol-Rijk. During the searches, they seized administrative records, laptops, phones, and other equipment.