Europol has successfully supported an international operation targeting a large-scale criminal network involved in the production, distribution, and sale of counterfeit medicines and dietary supplements. The operation, which took place across Poland, Romania, Hungary, Bulgaria, and Moldova, with judicial requests in a further 10 countries issued, aimed to dismantle the infrastructure supporting this illicit trade. To that end, a Joint Investigation Team was established at Eurojust.
The criminal organisation, comprising individuals from Romania, the Republic of Moldova, Bulgaria, Estonia, Poland, and Ukraine, has been operating for nearly two decades, generating at least EUR 240 million in illicit transactions, with up to EUR 70 million in 2021 alone. The network has been exploiting the vulnerability of individuals seeking treatments for serious diseases, such as diabetes, cancer, psoriasis, and weight loss, by promoting unauthorised dietary supplements through manipulative advertisements and fake endorsements.
The operation targeted various aspects of the criminal network. This involved investigating alleged legitimate producers and logistics companies involved in the distribution of counterfeit products. Law enforcement officers targeted call centres in Moldova and Romania, as well as warehouses and storage facilities in Bulgaria. One key goal was to identify and pursue key individuals within the criminal network.
Façade of legality
The criminal network was coordinated by leaders who established seemingly legitimate companies to sell these supplements. These companies maintained a façade of legality, with registered offices and bank accounts in multiple countries to collect proceeds from sales. Members of the network handled various administrative and technical roles, including commercial administration, recruitment, and training of new members, as well as the management of websites promoting the supplements.
The network’s promotional strategies involved placing manipulative advertisements on well-known sites to enhance credibility. Users were then redirected to secondary sites that promoted the supplements, often using fake endorsements from known medical figures and links to official health websites. This deception was further amplified through social engineering and deepfakes, convincing victims of the legitimacy of the promoted products.
Customer interaction and recruitment
Customers were required to provide personal information to order supplements, which was then used by call centre operators to finalise the sale. Call centres in Moldova have been searched and linked to this investigation. New members were recruited through a dedicated website, where they could learn to create fictitious social media accounts and promote the supplements. The site provided detailed instructions on creating and managing these accounts, including the use of anti-detection tools, proxy services, and fake photos and SIM cards.
Affiliates were encouraged to promote supplements for cardiovascular health, using local medical figures and “breaking news” to attract customers. Specific strategies were tailored to different regions, emphasising the ageing population and trust in doctors in Eastern Europe, particularly Romania. The group had launched extensive and misleading campaigns to promote their products as genuine treatments for serious diseases.
Large-scale seizures on action day
The action day took place on 12 May 2026, with authorities conducting 138 searches in Bulgaria, Greece, Hungary, Poland, Romania, and the Republic of Moldova. At least nine persons were arrested, dozens of electronic devices seized as well as cash, fake supplements, real estate and other assets worth at least EUR 17.7 million. While investigations into the criminal group will continue, the majority of the suspected members of the group were identified and some of the main members in Poland, Romania and the Republic of Moldova detained.
In Bulgaria, the central warehouse of the criminal group was identified. Tens of thousands of packages of over 300 types of illegally produced food supplements were seized, along with electronic devices and other evidence such as a significant volume of accounting, transport, and payment documents. Intervening officers also found machinery and high-tech equipment for production, as well as various substances of different origins, finished products, as well as shipments ready to be sent to customers.
In Romania, 196 websites used to promote and sell the supplements were blocked. During searches in Hungary and Romania, large quantities of supplements were seized and will now be further analysed. In Poland, assets worth EUR 1.8 million were frozen.
Illegal and unethical approach
The products offered by the criminal network were not legally registered and lack proper endorsements, clinical data, and quality controls. The composition of the products and the control of their manufacturing are unknown, further exacerbating the risks to public health. Such a sale of unauthorised supplements and misleading advertising raises not only significant legal but also ethical concerns.
Illicit medicines and supplements not only fund criminal groups across the globe, but may also cause serious harm to their victims. There is a greater risk of purchasing illicit medicines that have not undergone rigorous evaluation processes to ensure they are fit for the EU market when buying medicines from unregistered sources. Authorities warn citizens to only buy medicines from registered online pharmacies. Europol has issued an awareness campaign on fake medicines in partnership with the European Union Intellectual Property Office (EUIPO) and the European Medicines Agency (EMA). For more information, please read our dedicated report on the topic.
Europol’s support
Europol’s operational support included organising and hosting virtual and physical meetings over the last 2.5 years, participating in Eurojust coordination meetings, and facilitating close communication between several Member States and Third Parties. On the action day, Europol set up a Virtual Command Post (VCP) and deployed experts to assist the intervening authorities on the spot. Europol provided forensic support to colleagues in Romania, deployed an expert to Bulgaria with a mobile office, and financially supported the deployment of Romanian and Hungarian officers to actions in other countries.
Participating countries and agencies:
- Joint Investigation Team: Bulgaria, Hungary, Moldova, Poland, Romania, Europol, Eurojust
- Cyprus, Czechia, Estonia, Greece, Italy, Latvia, Lithuania, Slovakia, Slovenia, Spain
