What Operation Serengeti III actually covered
Police in 21 countries arrested 1,462 suspects in a cybercrime sweep that INTERPOL announced on Thursday, October 22. The operation disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds, according to The Hacker News.
The work ran from June 29 to August 31, 2026. Twenty of the 21 participating countries were African, and the United States was the 21st. Help Net Security framed the results as an African crackdown, and that framing fits most of the operation.
Operation Serengeti is an INTERPOL-coordinated series focused on African cybercrime. This year's effort is the third annual wave. The two earlier waves, held from September to October 2024 and from June to August 2025, produced more than 2,000 arrests combined.
The targets read like a list of threats that already hit American companies and households: cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Those categories come from a Group-IB release distributed through Zawya.
Where the United States fits in INTERPOL's 21-country crackdown
The US role was narrower than the headline count suggests. Before the raids, investigators from the 20 African countries and the United States received intelligence on suspicious domains, IP addresses and command-and-control servers, according to The Record. In this operation, the American contribution was data, not raids.
That distinction matters. Infrastructure intelligence helps police find and disable the servers criminals use to run scams and steal credentials, and it can disrupt those operations even when the suspects sit in another country.
Published accounts so far do not name US-specific arrests or recoveries. For American readers, though, the exposure is direct. Business email compromise and invoice fraud drain company bank accounts, and the operation's targets explicitly include both BEC and online scams. Investment and pension schemes appear in its national cases as well, including Nigeria and Uganda.
The US has pursued similar cases with African partners before. In August 2025, according to a secondary blog post that quotes an FBI release, the FBI announced the extradition of three Ghanaian nationals over a fraud ring that allegedly stole more than $100 million through romance scams and BEC. USA 24 could not check the FBI release directly, so treat those figures as the blog's account.
Which national cases stood out
The reporting breaks down several national actions, and three stand out for different reasons.
| Country | What authorities reported | Scale |
|---|---|---|
| Angola | Two illegal crypto-mining operations shut down and nine suspects arrested | More than 2,000 mining devices seized |
| Nigeria | Major phishing suspect arrested and a $2.4 million investment scam uncovered | Funds largely moved through cryptocurrency |
| Uganda | Investment and pension fraud arrests | 365 foreign nationals arrested |
Angola's case involves a different kind of crime. Authorities shut two illegal crypto-mining operations, arrested nine suspects and seized more than 2,000 mining devices, according to KuCoin's summary of the results.
Nigeria produced the clearest dollar figure. Police arrested a major phishing suspect and uncovered a $2.4 million investment scam, with funds largely moved through cryptocurrency, according to Nairametrics. The cryptocurrency element is worth watching, because digital transfers can move money across borders quickly.
Uganda's figure is the one most likely to catch a reader's eye. Authorities arrested 365 foreign nationals over investment and pension fraud schemes that targeted victims in Asia, according to The Hacker News. The reporting does not explain how those arrests were made or what charges followed.
How many victims and how much money INTERPOL counted
INTERPOL identified 65,929 victims. In an official statement, as The Hacker News reported it, the organization said: "Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today's digital threats." Financial investigations tied the activity to losses above $385 million.
Neal Jetton, INTERPOL's director of cybercrime, framed the problem in cross-border terms. In a statement reported by Security Boulevard, he said: "Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale." That argument fits an operation built on sharing data across national police forces.
Private firms also contributed. Group-IB and Team Cymru supplied threat intelligence and technical analysis, and Team Cymru described its role in a Business Wire release.
INTERPOL also says artificial intelligence is making cybercrime easier to scale, and it cited that trend when announcing the results, according to Sahara Reporters. INTERPOL's 2026 African Cyber Threat Assessment flagged rising AI use in cybercrime and growing financial losses across the continent, as TheGuildNG reported. For US readers, that trend is a reason to expect more scams of this kind, not fewer.
What the numbers do not tell you
Treat the headline figures as a starting point. Four caveats matter.
- Arrests are not convictions. Network counts may not compare cleanly across the three waves, so year-over-year comparisons call for caution.
- The framing differs. The Hacker News headline calls the effort a "global crackdown," while The Record and Security Boulevard describe an Africa-focused operation. The US role supports reading the results as Africa-led with American help.
- One victim figure is unverified. A BleepingComputer account, cited secondhand in WindowsForum's coverage, says a Nigerian suspect harvested credentials and amassed about 2.1 million email addresses. Neither source confirms that all of those addresses belonged to victims.
- The recovery split is unknown. The sources do not say how much of the $105 million traces to US-linked cases or how much went back to victims.
How to protect your business and savings from these scams
The steps below are general guidance rather than instructions from INTERPOL, but they fit the crime types the operation names.
- Verify any change to payment or wire instructions by calling a number you already have on file, never one listed in the message asking for the change.
- Require a second person to approve new payees or changed bank details before money moves.
- Treat unsolicited investment or pension offers with skepticism, especially those promising quick or guaranteed returns.
- Report suspected fraud to the FBI's Internet Crime Complaint Center at ic3.gov, and contact your bank right away, since fast reports give banks the best chance to stop transfers.
Browser tools can catch some lures before you act. USA 24 recently covered Chrome's Enhanced Protection update, which adds Gemini scam detection and ClickFix Guard.
What comes next for Operation Serengeti
Investigations are continuing, and more arrests may follow, according to The Record. Three developments are worth watching. First, whether INTERPOL releases a breakdown of the $105 million, including how much returned to victims. Second, whether later waves include more US-led cases or extraditions beyond intelligence sharing. Third, whether the annual rhythm holds, which would put a fourth wave in 2027. For American businesses, the most useful signal will be whether business email compromise and the other crimes named here keep appearing in the next round of arrests.
