Europol Just Admitted Cybercrime Is an Industry

Europol Just Admitted Cybercrime Is an Industry Europol’s IOCTA 2026 report, published on 28 April 2025, describes cybercrime not as isolated attacks but as a connected industrial economy. More than 120 active ransomware brands operated in 2025, with affiliate programmes offering margins of 80 to 85 per cent. Modern extortion has shifted from encryption to data leak threats, making backups necessary but insufficient. Industrial-scale SIM farms, such as the Latvian operation involving seven nationals, 1,200 devices, 40,000 SIM cards, and more than 49 million fraudulent accounts, now underpin the majority of online fraud. The report highlights enablers including residential proxies, bulletproof hosting, and crypto payment rails. Europol identifies a velocity gap: criminals move faster than law enforcement can respond. For UK small businesses, this matters because too much of the security industry still sells compliance theatre rather than defence against an industrial threat. This episode examines what the report actually says, what ransomware now looks like, why SMS authentication is dangerously weak, and three practical actions any small business can take this week. Chapters Intro Noel introduces Europol’s IOCTA 2026 report and argues that cybercrime has industrialised into a market with suppliers, customers, and margins, while too much of the security industry sells comfort rather than defence. What the report actually says Europol describes a connected criminal economy where the same infrastructure supports multiple crimes. Key enablers include residential proxies, bulletproof hosting, and SIM farms. The velocity gap means criminals move faster than law enforcement can respond. Ransomware now has brands More than 120 active ransomware brands operated in 2025. Qilin offered affiliates 80 to 85 per cent of ransom payments. Modern extortion has shifted towards threatening to publish stolen data, making backups necessary but insufficient. The industry response problem Noel argues that the security industry too often sells compliance theatre rather than defence matched to an industrial threat. Cyber Essentials is a necessary baseline, but a certificate is not a security posture. Exhibit A: seven Latvians, forty nine million accounts A Latvian SIM farm case involved seven nationals, 1,200 devices, 40,000 SIM cards, and more than 49 million fraudulent accounts. Industrial-scale SIM farms underpin the majority of online fraud, exposing the weakness of SMS as proof of identity. What to do this week Three practical actions: email your IT supplier to ask if they have read IOCTA 2026 and what they have changed, audit SMS authentication in dangerous workflows, and review your ransomware plan for data leak scenarios. Outro Noel directs listeners to the full write-up on the blog and previews Friday’s long-form investigation into the SIM farm case. Links https://www.europol.europa.eu/publications-events/main-reports/iocta-2026 https://www.europol.europa.eu/media-press/newsroom/news/latvian-sim-farm-operation-busted Links https://www.expressvpn.com/blog/ https://techcrunch.com/ https://cybernews.com/ https://www.scmagazine.com/ https://www.bitdefender.com/ https://www.securitymagazine.com/ https://www.wired.com/ https://vpnmentor.com/