• Interpol’s Operation First Light 2026 spanned 97 countries, leading to 5,811 arrests, $239M seized, and 31,014 bank accounts blocked
• Authorities analyzed 152,808 cases, identified 15,606 suspects, and uncovered scams ranging from BEC to money laundering, with victims exceeding 142,000 globally
• Notable busts included a fake Brazilian police station in Eswatini, crypto laundering in Thailand, and scam centers in Palau, highlighting the scale and diversity of the crackdown

Interpol and various national law enforcement agencies arrested more than 5,800 people and seized hundreds of millions of dollars in one of the largest crackdowns on cybercrime to date.

In an announcement, Interpol said that it kicked off Operation First Light 2026 on January 15 and concluded it on April 30, 2026. Following an “initial period” of gathering intelligence and exchanging it among partners, police forces in 97 countries and territories started raiding premises, seizing digital equipment and cash, and arresting suspects.

In total, 5,811 individuals were arrested, and $239 million in illicit assets intercepted. During Operation First Light 2026, various police forces analyzed 152,808 cases, had 31,014 bank accounts blocked, and 99 Notices and Diffusions issued.

A replica of a police station

Besides the arrests, the law enforcement firms also identified 15,606 suspects, which could lead to even more arrests in the coming months.

Interpol did not dismantle a single global operation here. Cases varied from money laundering, to scams and identity theft, to business email compromise, and more.

In one, particularly brazen campaign, police in Eswatini seized a “realistic replica of a Brazilian police station, complete with fake uniforms, signage and equipment”.

“Posing as Brazil’s Federal Police via video call, the scammers deceived their targets into believing they were victims of a crime, tricking them into transferring funds for “safekeeping,” which were then stolen,” Interpol explained. In this instance, police arrested 82 people and seized 240 electronic devices.

Two people were arrested in Thailand, including a 20-year-old man who allegedly processed more than $122.5 million in various cryptocurrencies in 10 months. Authorities in Palau, on the other hand, deported 22 individuals for their role in two connected scam centers being conducted from hotels.

Interpol said that during the operation it identified more than 142,000 victims globally.

• Check Point Research reports education faced 4,816 weekly ransomware attacks in June 2026, up 16% YoY, keeping it the most targeted sector
• Risks stem from open networks, thin budgets, and reckless GenAI use, with 1 in 26 enterprise prompts leaking sensitive data and 85% of orgs affected
• Latin America saw the sharpest rise (27%), while government and telecoms also absorbed heavy volumes, showing attackers’ focus on high‑exposure industries

Every week in June, organizations in the education industry around the world faced 4,816 ransomware attacks. This is up 16% compared to the same month last year, and means this sector remains the most popular target among cybercriminals.

This is according to “A New Ransomware Leader Emerges as June 2026 Attack Volumes Climb Worldwide”, a new in-depth report on the state of ransomware, published by security experts Check Point Research (CPR).

As per CPR’s new paper, education is a popular target because of “open campus networks, constant device turnover, and thin security budgets”. In other words, it’s a low-hanging fruit, especially compared to other industries like government, technology, or healthcare. But these are not the only reasons why hackers target education more than any other industry. It is also because of how employees behave which, by using GenAI recklessly, substantially increases security risk.

Latin America bearing the brunt

“It is about what employees place into prompts: customer records, internal documents, infrastructure details, legal material, financial data, or HR information that may be copied into public or unmanaged GenAI tools,” CPR explains.

“1 in every 26 GenAI prompts from enterprise networks carried a high risk of sensitive data leakage, equal to a global exposure rate of 3.9%,” the paper reads. “85% of organizations that regularly use GenAI tools were affected by high-risk prompt activity,” and “a further 27% of prompts contained potentially sensitive information.

This mostly affects organizations in Latin America who reported, on average, 3,501 weekly attacks (up 27% compared to June 2025). APAC followed at 3,060 (up 5%), and Africa posted 3,008 weekly attacks (down 9%).

Besides education, ransomware operators are also targeting government institutions (2,836 weekly attacks - up 5%), and telecoms (2,835 weekly attacks - up 13%).

“Together these three sectors continue to absorb a disproportionate share of global attack volume, a pattern that has held steady across recent months even as the specific numbers shift,” CPR concluded.