A service with more than 19,000 TV channels and nearly 100,000 titles from streaming platforms ran from Targovishte until the organised crime unit GDBOP shut it down on 7 October 2026. The case shows what cheap IPTV looks like from the inside: one administrator, other people's content, and subscribers who pay without knowing who gets their data.
IPTV means television over the internet. The technology itself is legal when the provider has the rights to the channels it carries. Illegal services take the broadcast from paid platforms, re-encode it and sell it by subscription, without paying the rights holders.
How the Targovishte raid went
The District Prosecutor's Office in Targovishte supervised the operation. GDBOP officers from Targovishte, Shumen and Razgrad took part, along with experts from the cybercrime directorate and a representative of Europol. Police searched an address in the city and identified the service's administrator. They searched two cars and seized the equipment they found.
Police are investigating an offence under Article 172a of the Criminal Code, which covers the unlawful use of copyright and related rights. According to the announcement, the service ran from March 2025 until the raid. There is no information on the number of subscribers, subscription prices or any charges. The presumption of innocence applies until a court rules.
What paying customers risk
The most direct risk is a shutdown. Once servers are seized or addresses blocked, those who paid are left with no service and no money, because there is nobody to ask for a refund. That is the case in Targovishte, where access to the service has been cut.
The second risk is payment data. The US group Digital Citizens Alliance registered a clean bank card with 20 illegal IPTV services. Within weeks, fake purchases were attempted with it from China, Singapore, Hong Kong and Lithuania, including groceries, clothes and software. Nobody checks the payment form of an unknown seller, and the seller keeps the card.
The third risk is apps and set-top boxes. According to a study by the same group, households with such devices are three times more likely to run into malware. Some services also use subscribers' internet connections for fraud. Europol warns of "malware, spyware, data theft and other forms of online exploitation". The quote is translated from English.
How to spot a legal provider
The first sign is price. A service that is free or much cheaper than legal ones is a warning sign, the EU Intellectual Property Office (EUIPO) warns. Many illegal sites deliberately look like official channels.
The second sign is what the service asks of the customer. A legal provider has a clear company behind it, a contract and usual ways to pay, and its market is regulated. This conclusion is the editors' own and is not a quote from a source. A set-top box with "all the channels in the world" for a few euros a month cannot have the rights to 19,000 channels, as many as the Targovishte service carried.
You can check legal offers on the European portal Agorateka, which lists sites with the right to offer films, series, music, sport and games. More than 5,300 legal sites from 27 European countries are linked to it. There is no information that the Bulgarian version of the portal was mentioned in reports on the case.
Targovishte is only one of the latest raids. Europol and Eurojust describe networks that use separate servers for the content and separate sites for customers, spread across different countries. In an earlier Eurojust operation, the group earned several million euros a month, which it hid through cryptocurrencies and shell companies.
In Bulgaria, the investigation in Targovishte continues under the supervision of the district prosecutor's office. GDBOP says it is working to establish who is behind the offence.