75,000 Users Just Got a Letter From Law Enforcement: Operation PowerOFF’s April 2026 Phase Is a New Kind of DDoS Crackdown

Seventy-five thousand people woke up to a message they didn’t expect: law enforcement knows who they are.

On April 13, 2026, Europol and partners from 21 countries wrapped up a coordinated action week targeting the global DDoS-for-hire ecosystem. The headline numbers — 53 domains seized, 4 arrests, 25 search warrants, 3 million criminal accounts exposed — are significant. But the number that matters most in the long run is 75,000: the count of identified users of illegal DDoS platforms who received direct warnings from law enforcement telling them they are in the databases, their activities are known, and future offenses will be prosecuted.

That is a strategic shift. For most of the past decade, Operation PowerOFF has focused on taking down the platforms themselves — dismantling the infrastructure, arresting operators, seizing domains. The April 2026 phase did all of that, and then turned to face the demand side of the market directly.

What Operation PowerOFF Is

Operation PowerOFF is the long-running international framework coordinated by Europol, the FBI, and partner agencies specifically targeting DDoS-for-hire services — also called “booter” or “stresser” platforms. The operation has been running since at least 2018 and has dismantled dozens of major platforms across multiple phases: Quantum Stresser, RoyalStresser, SecurityTeam, Astrostress, Booter.xyz, and others.

Each phase typically involves coordinated domain seizures, arrests of key operators, and asset forfeiture. The April 2026 phase is the largest in the operation’s history by the numbers — and the first to explicitly target the user base at scale rather than just the platform operators.

Breached.company previously covered the March 2026 Operation PowerOFF action in which the DOJ dismantled four IoT botnets responsible for record-breaking 30 Tbps attacks. The April phase is a separate Europol-led action with a different scope and a notably different strategic posture.

How the DDoS-for-Hire Market Works

A brief primer, because the numbers only make sense in context.

Booter platforms are online storefronts that sell access to distributed denial-of-service attack capacity. The operator maintains a botnet — a network of compromised routers, IoT devices, and servers — and rents out its firepower to paying customers who want to knock a specific target offline.

The customer enters a target IP or domain, selects attack duration and volume, pays in cryptocurrency, and the botnet does the rest. The target’s servers receive a flood of traffic they cannot handle, and go offline. Prices range from a few dollars for a short burst to thousands for a sustained volumetric assault.

The “stresser” branding these platforms use is a deliberate fig leaf: the pitch is “test your own server’s resilience,” but the actual customer use cases are gaming rivals, business extortion, hacktivism, and — increasingly — contracting for nation-state-adjacent information operations. The platforms don’t ask questions about the target. They just run the attack.

This is a market with real customers paying real money, and until recently, those customers had reason to believe law enforcement would never reach them. The platform operators were the targets. The buyers were functionally anonymous behind crypto payment rails and VPNs.

The April 2026 phase changed that assumption directly.

What the April 2026 Phase Achieved

Domain seizures and arrests: 53 domains connected to illegal DDoS-for-hire platforms were taken offline. Four individuals were arrested. Twenty-five search warrants were executed across participating jurisdictions. The participating countries included Australia, Austria, Belgium, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Portugal, Sweden, Thailand, the United Kingdom, and the United States.

Account database exposure: Seized infrastructure contained databases with information on more than 3 million accounts linked to DDoS-for-hire platforms. Three million people who used these services now have their account data in law enforcement hands.

The 75,000 warning messages: From those 3 million accounts, law enforcement identified 75,000 individuals considered active or high-priority users and sent them direct warning communications. The message, in substance: we have your data, we know what you did, and if you continue, prosecution follows. This is a deterrence play — designed to create a chilling effect across the entire user base by demonstrating that customers, not just operators, are within reach.

The Prevention Phase: Intercepting Customers Before They Become Criminals

The most novel element of the April 2026 phase is what Europol calls the “prevention phase” — a set of measures designed to disrupt the DDoS-for-hire market at the demand side before users even reach a platform.

Europol placed targeted search engine advertisements aimed at young people actively searching for DDoS tools — intercepting potential first-time users at the exact moment of intent and redirecting them to information about legal consequences. More than 100 URLs promoting illegal DDoS services were removed from search engine results. On-chain warning messages were embedded into illicit cryptocurrency payment flows associated with known booter platforms.

The logic is sound: most platform operators are themselves former customers who learned the business from the consumer side. If law enforcement can intercept the pipeline at the recruiting stage — before someone’s first purchase, before they normalize the behavior, before they build relationships in the community — the conversion rate from curious teenager to career cybercriminal drops. That is a long-term investment, not a short-term win, but the April 2026 phase is the first time Europol has deployed it at this scale.

The Noah Christopher Connection

The April 2026 PowerOFF phase did not occur in isolation. It ran concurrently with a pattern of individual arrests targeting DDoS-for-hire operators that Breached.company has been tracking.

Most directly: the April 11 arrest of Noah Christopher — a 27-year-old German national apprehended at a luxury condominium in Bangkok under 74 German and EU arrest warrants — fits squarely within the PowerOFF enforcement framework. Christopher allegedly operated Fluxstress and Netdowner, DDoS-for-hire platforms that rented botnet capacity to paying customers between 2021 and 2025. He had been moving between the UAE, China, and Thailand for years to evade the warrants.

The full account of that arrest is in our Noah Christopher / Fluxstress coverage. The broader point: PowerOFF’s April action week and the Christopher arrest two days earlier are part of the same coordinated enforcement surge. The domains come down, the operators get arrested, and now the customers get warned — all within the same operational window.

What This Means for the DDoS-for-Hire Market

The DDoS-for-hire industry has historically been remarkably resilient to law enforcement pressure. When a major platform is taken down, the customer base migrates to alternatives within days. The operators are replaceable; the demand is not. Every previous phase of PowerOFF has produced the same cycle: seizure, migration, reconstitution.

The April 2026 phase represents a genuine attempt to break that cycle by attacking demand rather than just supply. Three things make this phase different from its predecessors:

Scale of customer identification. Three million accounts in law enforcement databases is an unprecedented dataset. Even if most of those accounts never face individual prosecution, they represent intelligence on the user community — who they are, how they pay, what targets they select, and which platforms they prefer. That intelligence has compounding value across future phases.

The warning message as a prosecutorial on-ramp. Recipients of the 75,000 warning messages cannot now claim they were unaware their activity was illegal or that they had no notice from authorities. Any future DDoS attack traced to one of those users occurs after documented law enforcement contact. That changes the prosecutorial calculus significantly — prior warning is an aggravating factor.

The search advertising intervention. Intercepting first-time buyers at the search layer is a customer-acquisition disruption. Booter platforms depend on a constant supply of new customers to replace churn. If the top of the funnel is compromised — if searching for “DDoS service” returns a law enforcement PSA instead of a storefront — that supply dries up faster than any domain seizure can achieve.

Whether this phase produces lasting market contraction or simply accelerates migration to darker, harder-to-monitor infrastructure is the open question. The market’s history suggests the latter is at least partly inevitable. But the combination of scale, customer identification, and demand-side disruption in the April 2026 phase is qualitatively different from anything PowerOFF has deployed before.

Seventy-five thousand people have been told law enforcement is watching. The ones who keep going anyway will be making a documented choice.

Sources: Europol Operation PowerOFF press release; BleepingComputer; The Hacker News; The Record.

Breached.Company tracks cybercrime enforcement actions, breach disclosures, and threat actor operations. For DDoS defense strategy and incident response retainers, CISO Marketplace connects you with vetted advisors.