INTERPOL Operation Serengeti III Disrupts 10,909 Malicious Networks, Recovers $105 M and Arrests 1,462 Cybercriminals

What happened

From 29 June to 31 August 2026, INTERPOL coordinated 21 national law‑enforcement agencies in Operation Serengeti III. The effort disrupted 10,909 malicious networks, seized illicit funds exceeding $105 million and placed 1,462 suspects in custody. Targets included ransomware distributors, BEC operators, fraudulent investment schemes and illegal cryptocurrency mining sites, impacting an estimated 65,929 victims worldwide.

Why it matters for trust and compliance

• The scale of social‑engineering fraud demonstrates why organizations must embed continuous security‑awareness training and maintain defensible evidence of incident handling—key components of a control‑assurance program that maps to multiple frameworks.
• Demonstrates the need for documented employee‑awareness controls that can be audited across frameworks.
• Provides a real‑world example of evidence collection that supports incident‑response and forensic readiness.

Who is affected

Recommended actions

1. Update security‑awareness curricula with the latest BEC/phishing tactics identified in the operation.
2. Run periodic, realistic phishing simulations and retain response metrics as audit evidence.
3. Validate that incident‑response playbooks include evidence‑preservation steps aligned with regulatory expectations.