Operation Switch Off: what we know about Europe’s takedown of three major illegal IPTV services

European law enforcement agencies announced in late January 2026 that a coordinated operation had dismantled the technical infrastructure behind three large unauthorized IPTV services. The services were IPTVItalia, migliorIPTV and DarkTV. The action, called Operation Switch Off, was led from Italy and involved suspects and servers in several other countries.

This article sets out what the authorities and reputable outlets have confirmed, and what the case shows about how illegal IPTV is now organized and policed.

Operation Switch Off: the confirmed facts

According to reporting by BleepingComputer, published on January 30, 2026:

• The investigation was run by the District Prosecutor's Office of Catania and the Italian State Police, with support from Europol, Eurojust and Interpol.
• Police identified 31 suspects: 11 in Italy and 14 across the United Kingdom, Spain, Romania and Kosovo. Bulgaria was also involved in the wider operation.
• Investigators dismantled six servers in Romania and identified another server located in Africa.
• In Italy alone, the services reached more than 250 resellers and about 100,000 subscribers.
• The services retransmitted content from pay-TV and streaming companies including Sky, DAZN, Mediaset, Amazon Prime Video, Netflix, Paramount and Disney+.

Italian police said the action dismantled infrastructure that had served "millions of end-users, nationally and internationally." The Alliance for Creativity and Entertainment (ACE), the anti-piracy coalition whose members include major studios and streamers, publicly welcomed the operation.

The timing was noted in coverage: the action came days before the Milan–Cortina Winter Olympics opened on February 6, 2026. Major live sports events have repeatedly been a focus of anti-piracy work.

How these services were structured

The reported figures, such as hundreds of resellers in a single country, reflect a model common in unauthorized IPTV. A small group runs the technical side: capturing channels, re-encoding them and serving them from rented servers. A much larger network of resellers then sells subscriptions, often through messaging apps, social media and websites that look like ordinary retailers.

For viewers, this means the person who sold them a subscription is often not the person running it. When the infrastructure goes down, as it did here, subscribers usually lose access immediately and have no practical way to recover what they paid.

The technical side: how pay TV ends up on unauthorized servers

Unauthorized IPTV services generally obtain channels in one of a few ways:

• Restreaming legitimate subscriptions. Operators buy genuine pay-TV or streaming subscriptions, capture the output, and re-encode it for redistribution.
• Card sharing and decryption. Older methods involve sharing the keys used to decrypt satellite or cable signals across many receivers.
• Capturing feeds upstream. In some cases, feeds are taken from points in the distribution chain before they reach consumers.

The captured channels are then encoded, often at several quality levels, and served from rented servers, frequently spread across several countries and hosting providers to make takedowns harder. Customers access them through playlists or portal logins in player apps, which is why authorities often talk about "infrastructure" rather than a single website.

Why resellers matter

The reseller layer has two effects. It spreads sales widely, through social media, messaging apps and word of mouth, and it distances the operators from customers. It also means that when a service is shut down, many people who paid a reseller discover that the seller has no control over the service and no way to provide refunds.

Why international cooperation matters

Unauthorized IPTV services rarely sit in one jurisdiction. Servers, operators, resellers and payment channels are often spread across several countries, deliberately. Operations like Switch Off depend on agencies such as Europol and Eurojust, which coordinate investigations and the legal requests needed to act on servers and suspects in different states.

How Italy's approach has developed

Italy has been one of the most active European countries against illegal streaming in recent years, particularly around live football. Its communications regulator, AGCOM, operates a system known as Piracy Shield, designed to order rapid blocking of domains and IP addresses used for live piracy. The platform has been praised by rights holders and criticized by some internet groups over the risk of blocking legitimate services by mistake.

Operation Switch Off fits a pattern of Italian prosecutors working with European agencies against the infrastructure behind unauthorized IPTV, alongside regulatory blocking of individual streams.

A short glossary of the agencies involved

Most large takedowns involve the same basic sequence: an investigation identifies servers and suspects, judicial authorities authorize searches and seizures in each country, and coordinated action happens on the same day so operators can't move infrastructure in time.

What happens next

Identifying suspects is the start of a legal process, not the end of one. People named as suspects have not been convicted, and any prosecutions will proceed under the relevant national laws. We will update this article if prosecutors or Europol publish further official details.

Questions readers often ask

Are subscribers at risk of prosecution?

That depends on national law, and we can't give legal advice. Some European countries, including Italy, have taken steps to penalize users of pirated streams as well as operators. The more common practical consequences are losing access without a refund and the security risks of the apps and payment methods involved.

Why don't these services just disappear for good?

Because the barriers to starting a new service are low. Operators can rent new servers, rebrand and recruit resellers. That's why authorities now try to target the people and infrastructure behind services rather than individual websites or streams alone.

How can I tell if a service I'm considering is legitimate?

See our step-by-step guide to telling legitimate IPTV services apart. The short version: an identifiable company, official apps, normal payment methods and a realistic channel line-up for your country.

Timeline

How this compares with other enforcement actions

Enforcement against unauthorized IPTV generally follows one of three patterns:

• Infrastructure takedowns, like Switch Off, which target the servers and people running a service
• Domain seizures, like the US Operation Offsides, which target the websites used to promote or deliver streams
• Blocking orders, issued by courts or regulators, which require internet providers to block access to specific services

Each has strengths and limits. Takedowns can end a service but take months of investigation. Seizures and blocking act faster but are easier to work around. Rights holders and authorities increasingly combine all three.

Why it matters beyond Italy

Several of the suspects were outside Italy, and the services reportedly served viewers internationally. That's typical. Unauthorized IPTV services rarely respect national borders, either in where they operate or whom they sell to. For viewers anywhere, the lesson from Switch Off is that an apparently stable service can disappear overnight, with no warning and no refund.

What remains unclear

Several questions weren't answered in the reporting we reviewed:

• How many subscribers outside Italy were affected, beyond the general statement about millions of end-users
• What charges, if any, the suspects will face, and in which countries
• Whether other services shared the same infrastructure and were also disrupted
• What happens to subscriber data seized with the servers

We'll update this article if authorities publish more details. Readers with official documents or statements we should consider can email us at info@iptvnews.site.

Key points

• Italian authorities, supported by Europol, Eurojust and Interpol, announced the dismantling of IPTVItalia, migliorIPTV and DarkTV in late January 2026.
• 31 suspects were identified across Italy, the UK, Spain, Romania and Kosovo, according to reporting.
• The services reached more than 250 resellers and about 100,000 subscribers in Italy alone.
• Content from major pay-TV and streaming companies was retransmitted without authorization.
• Suspects have not been convicted, and legal proceedings follow national law.

What it means for viewers

The lesson for consumers is practical. A cheap "all channels" subscription can disappear overnight, and paying for one often means handing payment details to unknown operators. If you want to check whether a service is legitimate before subscribing, see our guide on how to tell legal IPTV services apart. For the security side, read our analysis of malware and fraud risks in illegal IPTV.

Operation Switch Off was followed months later by a large US action during the FIFA World Cup. We cover that in our report on Operation Offsides.

Sources and further reading

• BleepingComputer: Operation Switch Off dismantles major pirate TV streaming services (January 30, 2026)
• Advanced Television: ACE welcomes Operation Switch Off success
• Europol (official website)