Security1 distinct publisher2 min readPublished
Milan Ibrahim drew more than six years for a £980,812 subscription business run on 80 machines in Chorley. The police kept the machines, and say they may lead to the identification of the customers who paid.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
PIPCU's wording is conditional exactly where it counts. The unit says seizing the 80 machines "may lead to the identification of users" of the service, who could then pay fines or face other ramifications for funding copyright infringement [7]. It does not say subscriber records were recovered, or how many accounts they describe [16]. BleepingComputer's questions to PIPCU and to FACT, which took part in the action, were unanswered at publication [11].
The revenue splits cleanly enough to be useful. £980,812 across three years is £326,937 a year [12]. Across 80 servers that is about £12,260 per box for the whole period, near £4,087 per box per year [13][14]. That sizes the supply side and nothing else, because no subscriber count has been published [16]. It is worth noting what the estate looked like: 80 machines at premises in Chorley is in-house hardware, not capacity rented in pieces across several jurisdictions [4], and in-house hardware is the version that ends up whole in an evidence room rather than partly behind a foreign host's refusal to co-operate.
Keep the public record and the inference apart. UK government records show Ibrahim was a director of CTU Systems, a now-dissolved company that marketed IPTV software, and authorities have not identified CTU Systems as connected to the service prosecuted in this case [10]. That is a filing, not a finding.
The report carries no date for the arrest, the raid, or the sentencing; the only interval stated is the three years of trading [15]. For anyone weighing the subscriber question, that absence matters more than it looks, because it puts no clock on how long investigators have held the hardware and no clock on how far any downstream analysis has already run. Until PIPCU or FACT says otherwise, demand-side consequences are a possibility the police have raised rather than a step they have described [7][11]. The supply-side result is the part that is settled: every server the investigators found was taken and switched off, which the force says significantly disrupted the operation's ability to stream [5][6].
Ranked by verification strength, evidence, and original report placement.
The City of London Police said all 80 servers were seized and shut down during enforcement activity, significantly disrupting the operation's ability to provide illegal streaming services.
Police seized and shut down all servers they found during the operation, disrupting the illegal streams that users of the service received.
A 68-year-old, Milan Ibrahim, was sentenced in the UK to more than six years in prison for operating an illegal IPTV service that generated £980,812 (about $1.3 million) over three years.
An investigation by the Police Intellectual Property Crime Unit (PIPCU) at the City of London Police found that Ibrahim ran a "sophisticated operation" providing illegal IPTV services to users in the UK and abroad.
According to PIPCU, Ibrahim sold illegal broadcasts from major rights holders including the BBC, ITV, Sky, the Premier League and the Motion Picture Association.
The City of London Police said the business operated on 80 servers from premises in Chorley and generated £980,812 over a three-year period.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 28, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
product
The UK plant that went dark for four days was too small to have to tell anyone1 distinct publisher
product
From $50 to $2.25M: Niu Lai prices human authorship, not AI reputational risk2 distinct publishers
build
A UDP packet is now enough: IKEEXT RCE moves from patch queue to fire drill1 distinct publisher
security
ShinyHunters dumps 12.9 million Carhartt records after a refused $3.3 million ransom1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One police announcement, quoted straight
Strip out the quotation marks and almost nothing is left standing on its own: the server count, the premises, the £980,812 and the disruption claim all come from a single City of London Police statement that BleepingComputer reproduces. The outlet does two things that raise the floor — it flags that authorities have not connected the dissolved CTU Systems to this case, and it says its questions to FACT and PIPCU were unanswered. It also leaves the case undated, which makes the record harder to check against a court listing.
Takedown done, subscriber phase entirely prospective
Split what has happened from what is merely announced and the balance is lopsided. Real: 80 machines gone, a sentence handed down. Announced only: confiscation proceedings, and the suggestion that customers might be found and fined. No fine, charge, letter or subscriber figure appears anywhere in this reporting, and the mechanism for identifying users — recovered customer records — is never actually claimed.
Gross takings read as earnings; subscriber threat read as plan
Two stretches, neither egregious. 'Making $1.3 million' describes revenue across three years — before servers, bandwidth and everything else — and the per-server arithmetic, about £4,087 a machine a year, sits oddly beside a rights holder calling this one of the UK's most prominent pirate suppliers. And the most quotable line, that the seizure may expose the customers, is a possibility carried forward without any stated evidence that customer records were recovered. Our own framing leans on that possibility too.
Everyone quoted gains from the deterrent message
The police are describing their own win, the Premier League's legal enforcement director is describing a threat to his employer's product, and FACT — a rights-holder-funded body — was a participant in the action. Nobody in the piece has an interest in a smaller number or a narrower claim, and the warning to subscribers is exactly the message rights holders most want circulated. Worth noting too that the page closes with a vendor report promotion, which sits outside the reporting but shapes how the piece is packaged.
Credible official account, single channel, no dates
Direct quotation from a named police force makes the core facts hard to dispute, and BleepingComputer's flagged caveats improve the reading. What holds the number down is structural: one outlet, one upstream source, no independent check on the 80 servers or the £980,812, no timeline, and an unanswered request for detail to the two bodies best placed to supply it.