[Back to the takedown index](https://takedownindex.org/takedowns) # EncroChat interception and shutdown April 2020, Criminal communications Led by [Gendarmerie nationale](https://takedownindex.org/organizations/gendarmerie-nationale), [Politie (Netherlands National Police)](https://takedownindex.org/organizations/politie-netherlands-national-police) Verified core entry, last reviewed August 21, 2026 What was taken down? Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? No individual outcomes are recorded against this entry. Group accounted for: Not applicable [See people and accountability](#people) Did it stay down? After this action later activity was recorded, though its link to the original is not established. Medium confidence in the link between the two. [See what happened afterward](#afterward) ## What happened A French and Dutch joint investigation team placed a technical implant on EncroChat's France-hosted servers, harvesting messages from roughly 60,000 users before the network was shut down.[[1]](#source-1)[[2]](#source-2) Announced July 2, 2020. **Date:** April 1 to June 13, 2020 **Target:** EncroChat, encrypted communications network **Activity:** Criminal communications, Trafficking and exploitation **Operational lead:** French Gendarmerie and Dutch National Police **Partners** Europol, Eurojust, and 1 more[[1]](#source-1)[[2]](#source-2) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [European Union Agency for Criminal Justice Cooperation](https://takedownindex.org/organizations/european-union-agency-for-criminal-justice-cooperation), judicial cooperation - [National Crime Agency](https://takedownindex.org/organizations/national-crime-agency), supporting **Jurisdiction:** France, Netherlands, United Kingdom, Sweden, Norway, and European Union **Outcome:** Server infrastructure in France compromised by a law-enforcement implant; more than 100 million messages intercepted; network shut down and users warned by the operator. **Status:** Completed **Legal mechanism:** French judicial authorization for the technical device; Joint Investigation Team with the Netherlands; European Investigation Orders; Europol and Eurojust coordination **Group accounted for:** Not applicable ### Infrastructure 60,000 user accounts searched. Servers taken over, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | Server | Taken over, France | France-hosted server infrastructure compromised by a law-enforcement technical implant.[[1]](#source-1) | | Not published | approximately 60,000 user accounts | Searched | Approximately 60,000 users, with more than 100 million messages intercepted.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Not applicable The service is not a finite criminal operator group. Arrest totals reflect users of the platform, not its operators. Not applicable. The target was a communications service used by many unrelated criminal groups. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/encrochat-interception-and-shutdown/organizations) ## What happened afterward Thousands of prosecutions across Europe. Several courts have since challenged or excluded EncroChat-derived evidence.[[1]](#source-1)[[2]](#source-2) Date not established No documented return. Relationship not established. Confidence: Medium. Not established.[[1]](#source-1) The EncroChat service did not return. Users migrated to other encrypted platforms including Sky ECC, which was itself later targeted. Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Dismantling of an encrypted network sends shockwaves through organised crime groups across Europe](https://takedownindex.org/sources/europol-dismantling-of-an-encrypted-network-sends-shockwaves-through-organised-c) Europol, July 2, 2020, Source grade P2 Joint investigation team structure, technical implant on France-hosted servers, user and message scale No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [NCA statement on Operation Venetic](https://takedownindex.org/sources/national-crime-agency-nca-statement-on-operation-venetic) National Crime Agency, July 2, 2020, Source grade P2 UK arrest and seizure figures No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - UK NCA initially reported 746 arrests, later revised upward past 1,500 as cases progressed. Both figures are aggregate user arrests, not operator arrests. - CONFLICTING LEGAL RECORD. Courts in several jurisdictions have since ruled on the admissibility of the intercepted material with differing outcomes. This does not affect the fact of the infrastructure action. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 2 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Operation Ladybird](https://takedownindex.org/takedowns/operation-ladybird) - [Sky ECC interception and action day](https://takedownindex.org/takedowns/sky-ecc-interception-and-action-day) - [DoubleVPN takedown](https://takedownindex.org/takedowns/doublevpn-takedown) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)