Police dismantle family-run IPTV piracy ring with 86,000 subscribers across 12 countries
Seven members of a criminal organization were arrested in coordinated raids on 16 June 2026 in Crete, Attica, Agrinio, Corfu and Samos, ending a nine-year operation that stole content from Netflix, Cosmote TV, Disney+ and others.
Undercover infiltration
A police officer from the organised crime unit posed as a prospective customer for two months, gaining subscriber access. That infiltration allowed authorities to map how the organisation installed pirated software on televisions and activated subscriptions through a central management panel.
Nine years of piracy
Since at least 2017, the group ran a professional illegal IPTV business. Using specialised decoders, servers in Greece and abroad, VPNs and constantly rotating IP addresses, they captured live channels, films, series and sports from providers such as Netflix, Cosmote TV, Nova, Disney+, Amazon, Bundesliga, Serie A, ANT1+ and Apple TV and rebroadcast them at far lower prices. A database seized by police contained more than 86,000 customer records.
- Criminal organisation begins illegally streaming subscription TV content.
- Undercover officer infiltrates the network as a subscriber.
- Coordinated police raids in five regions; seven members arrested.
Money laundering and luxury
The illicit proceeds exceeded €7 million, while damage to legal platforms surpassed €50 million. To hide the income stream, members routed money through 58 bank accounts in 12 European countries (including Luxembourg, Switzerland, France, Belgium and the UK), e-wallets, cryptocurrencies, prepaid cards and cash. The cash financed luxury holidays, expensive hotels, property purchases and the immediate repayment of mortgage loans. During searches, police recovered over €18,885 in cash, four cars and a motorcycle.
- Illegal profits
- 7 € million
- Damage to providers
- 50 € million
International infrastructure
The group spent more than €280,000 on logistics infrastructure, maintaining servers in Ukraine, Bulgaria and Agrinio, plus proxy servers and domain-name changes to evade blocking. A 24-hour technical support desk ensured uninterrupted service. Customers were located in Germany, Australia, Cyprus, the United Kingdom, Poland, Italy, Sweden, Portugal, New Zealand, Canada, the Netherlands and China.
Raids and arrests
Simultaneous operations across five Greek regions led to the arrest of six men and one woman, aged 31 to 73. The case file includes a further five alleged accomplices and 71 end-users. Among those detained were a father and his two sons, as well as two brothers. Charges cover professional and repeat criminal organisation, intellectual property infringement, protection of subscription services and aggravated money laundering.
