Operation Endgame seized 6.4 million stolen data records in a global crackdown, Europol said on November 12, 2026. Police and private firms took action against 235 servers and 257 domains, the agency said.
Dutch police took part in the raids. They said the stolen data could help criminals steal money or break into company networks. Their count refers to data items, not a count of people.
What Operation Endgame targeted
Europol said the raids hit three types of malware, or harmful software. Criminals used these tools to help carry out more crimes. Each had a different role:
- Gootloader spread malware through fake legal papers on hacked sites, often built with WordPress.
- CastleRAT let attackers control a PC from afar. RAT stands for remote access trojan.
- StealC stole passwords, saved login details and other private data from PCs.
Dutch police said the Gootloader group also rigged search results to draw people to hacked sites. These attacks could lead to ransomware. That software locks files or systems, so people cannot reach their own data.
Seized data can still pose a risk
Dutch police guidance explains a risk that remains after Operation Endgame. Seizing data does not make stolen passwords safe again. Criminals may still hold copies, and malware left on a PC may also steal a new password. So the advice is to remove the malware first, then change passwords.
The police’s Check your hack tool tests an email address against seized data. It sends an email if it finds a match. But police warn that no match does not prove an address is safe. Data may have leaked elsewhere.
Website owners have another task
A Dutch police factsheet warns that attackers can add harmful code and extra admin accounts to WordPress sites. It tells owners to change passwords and use multifactor authentication. They should also remove harmful code and unknown accounts, or ask their site manager or host for help.
For Operation Endgame, Dutch police said CastleRAT data was already in its checking tool on November 12. They planned to add more records over the weeks after that date. Europol also said Have I Been Pwned and other groups would help warn people about stolen login details.
Sources: Europol, Dutch police operation report, Dutch police checking guidance, Dutch police checking tool, Dutch police WordPress factsheet
