[Back to the takedown index](https://takedownindex.org/takedowns) # Operation Cookie Monster April 2023, Fraud and stolen data Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), [Politie (Netherlands National Police)](https://takedownindex.org/organizations/politie-netherlands-national-police) Verified core entry, last reviewed August 21, 2026 What was taken down? Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) [See what happened](#what-happened) What happened to the people? Officials reported 119 apprehended. Group accounted for: Partial [See people and accountability](#people) Did it stay down? Not established in the public record. No later activity is recorded against this entry. [See what happened afterward](#afterward) ## What happened FBI and Dutch National Police led a 17-country action seizing the clearnet domains and infrastructure of Genesis Market, which sold stolen credentials packaged with browser fingerprints and cookies.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Announced April 5, 2023. **Date:** April 4 to April 5, 2023 **Target:** Genesis Market, criminal marketplace **Activity:** Fraud and stolen data, Phishing, Malware and botnets **Operational lead:** FBI and Dutch National Police **Partners** Europol, Qintel, and 1 more[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [Qintel](https://takedownindex.org/organizations/qintel), technical partner - [National Crime Agency](https://takedownindex.org/organizations/national-crime-agency), supporting **Jurisdiction:** United States, Netherlands, United Kingdom, and European Union **Outcome:** Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice. **Status:** Completed **Legal mechanism:** US seizure warrant (Eastern District of Wisconsin); parallel Dutch and partner judicial process; Europol and Eurojust coordination **Group accounted for:** Partial ### Infrastructure 11 domains seized. Servers seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | 11 domains | Seized, United States | Eleven domains seized under a warrant issued in the Eastern District of Wisconsin. Some reporting cites approximately 24 domains; CONFLICTING and not harmonized. Resolved to the official DOJ figure of 11 domains (E.D. Wisconsin warrant); a commonly repeated ~24 figure is not a DOJ number.[[1]](#source-1) | | Not published | Server | Seized, United States | US-based servers supporting the marketplace.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Partial Infrastructure was seized and a large number of users arrested, but no core administrator was publicly identified, charged, or apprehended. Core administrators were never publicly identified. The 119 arrests were predominantly users and customers. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-cookie-monster/organizations) ## What happened afterward Follow-on arrests continued in multiple countries after the action date.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Not established in the public record. No later activity is recorded against this entry. Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Genesis Market, a major initial access broker, seized in international operation](https://takedownindex.org/sources/united-states-department-of-justice-genesis-market-a-major-initial-access-broker) United States Department of Justice, April 5, 2023, Source grade P1 Domain seizures under an EDWI warrant, US server seizures No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Takedown of Genesis Market, the largest online marketplace for stolen credentials](https://takedownindex.org/sources/europol-takedown-of-genesis-market-the-largest-online-marketplace-for-stolen-cre) Europol, April 5, 2023, Source grade P2 17-country coordination, 119 arrests, 208 property searches No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 3. [NCA statement on Operation Cookie Monster](https://takedownindex.org/sources/national-crime-agency-nca-statement-on-operation-cookie-monster) National Crime Agency, April 5, 2023, Source grade P2 UK arrests and searches No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - 119 arrests and 208 property searches are official aggregate figures across 13 countries and are not converted into person records. - Approximately 1.5 million compromised devices and 80 million credentials are victim-side figures, not operator counts. - Reporting indicates the Tor mirror was not immediately affected by the clearnet seizure. Recorded as a partial technical outcome. - OFAC sanctioned Genesis Market separately. Sanctions are not treated as charges. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [BreachForums shutdown following administrator arrest](https://takedownindex.org/takedowns/breachforums-shutdown-following-administrator-arrest) - [ChipMixer takedown](https://takedownindex.org/takedowns/chipmixer-takedown) - [Operation MEDUSA](https://takedownindex.org/takedowns/operation-medusa) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)