Skip to main content
Back to the takedown index

EncroChat interception and shutdown

April 2020, Criminal communications
Led by Gendarmerie nationale, Politie (Netherlands National Police)

Verified core entry, last reviewed August 21, 2026

What was taken down?

Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.[1][2]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

See people and accountability

Did it stay down?

After this action later activity was recorded, though its link to the original is not established. Medium confidence in the link between the two.

See what happened afterward

A French and Dutch joint investigation team placed a technical implant on EncroChat's France-hosted servers, harvesting messages from roughly 60,000 users before the network was shut down.[1][2]

Announced July 2, 2020.

Date
April 1 to June 13, 2020
Target
EncroChat, encrypted communications network
Activity
Criminal communications, Trafficking and exploitation
Operational lead
French Gendarmerie and Dutch National Police
Partners
Europol, Eurojust, and 1 more[1][2]
Jurisdiction
France, Netherlands, United Kingdom, Sweden, Norway, and European Union
Outcome
Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.
Status
Completed
Legal mechanism
French judicial authorization for the technical device; Joint Investigation Team with the Netherlands; European Investigation Orders; Europol and Eurojust coordination
Group accounted for
Not applicable

Infrastructure

60,000 user accounts searched. Servers taken over, with no count in the record.

approximately 60,000
user accounts searched
Identifier Recorded as Status Notes
Not published Server Taken over, France France-hosted server infrastructure compromised by a law-enforcement technical implant.[1]
Not published approximately 60,000 user accounts Searched Approximately 60,000 users, with more than 100 million messages intercepted.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

The service is not a finite criminal operator group. Arrest totals reflect users of the platform, not its operators.

Not applicable. The target was a communications service used by many unrelated criminal groups.

See the organizations and roles behind this action

Thousands of prosecutions across Europe. Several courts have since challenged or excluded EncroChat-derived evidence.[1][2]

  1. Date not established

    No documented return. Relationship not established. Confidence: Medium. Not established.[1]

    The EncroChat service did not return. Users migrated to other encrypted platforms including Sky ECC, which was itself later targeted.

Date not established

No documented return. Relationship not established. Confidence: Medium. Not established.[1]

The EncroChat service did not return. Users migrated to other encrypted platforms including Sky ECC, which was itself later targeted.

Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Dismantling of an encrypted network sends shockwaves through organised crime groups across Europe

    Europol, July 2, 2020, Source grade P2

    Joint investigation team structure, technical implant on France-hosted servers, user and message scale

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    NCA statement on Operation Venetic

    National Crime Agency, July 2, 2020, Source grade P2

    UK arrest and seizure figures

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • UK NCA initially reported 746 arrests, later revised upward past 1,500 as cases progressed. Both figures are aggregate user arrests, not operator arrests.
  • CONFLICTING LEGAL RECORD. Courts in several jurisdictions have since ruled on the admissibility of the intercepted material with differing outcomes. This does not affect the fact of the infrastructure action.