Cybersecurity
Police arrest 16-year-old suspected of running KillSec
Spanish, German and other authorities arrested three people linked to KillSec, took over its leak site and servers, and said the investigation covered about 1,000 suspected attacks worldwide so far.
- Spanish police arrested a 16-year-old in Alicante on 30 September in the KillSec inquiry.
- Hamburg police said investigators saw him as the group's suspected administrator and chief operator, and German police led the operation.
- Authorities said they searched eight sites in Spain, Greece, the U.K. and Romania, secured at least 110 terabytes of material and shut down five servers.
- DIICOT said it detained a 24-year-old in Romania, searched four homes and asked a Bucharest court to hold him for 30 days.
- U.S. prosecutors in Puerto Rico said they sought extradition of the man arrested in the U.K., while Europol and Eurojust coordinated the wider case.
Spanish police detained the 16-year-old in Alicante on 30 September, and Hamburg police later said investigators identified him as KillSec's suspected administrator and chief operator. Police in Hamburg led the wider operation.
The Guardia Civil and Mossos d'Esquadra said they also searched a home and a hotel office in the province. Europol said the other two arrests were men in their 20s, one in the U.K. and one in Romania.
In Romania, DIICOT detained a 24-year-old and searched four homes in Bucharest and Vaslui county. It said he was being investigated for organised crime, illegal access to a computer system, unauthorised transfer of computer data, offences involving devices or software, and blackmail, and it asked a Bucharest court to keep him in custody for 30 days.
Authorities said they searched eight premises in Spain, Greece, the U.K. and Romania, and secured at least 110 terabytes of data when they took control of the leak site. Hamburg police said they had also shut five servers and marked five domains for seizure, while Spanish police said they took devices, phones and cryptocurrency wallets.
The Guardia Civil said its inquiry began in 2025 with the FBI's San Juan office, and the Mossos d'Esquadra opened a separate case after an attack on a Catalan organisation in early 2025. Europol and Eurojust coordinated the work, while Bitdefender and Group-IB supported it.
Named in this story
Companies
- Bitdefender
- supported the investigation
- Group-IB
- supported the investigation
Organisations
- KillSec
- the group under investigation
Governments and agencies
- Hamburg police
- led the operation and identified the suspect
- Guardia Civil
- detained the suspect in Alicante
- Mossos d'Esquadra
- joined the detention and searched premises
- Europol
- coordinated the work and described the arrests
- Eurojust
- coordinated the investigation and said the group was shut down
- DIICOT
- detained a suspect in Romania and set out the charges
- FBI's San Juan office
- took part in the operation
- U.S. prosecutors in Puerto Rico
- joined the operation and sought extradition
Places
- Spain
- where one arrest and several searches took place
- Alicante
- where the 16-year-old was detained
- Hamburg
- where police led the case
- the U.K.
- where one suspect was arrested
- Romania
- where one suspect was detained and searches were carried out
- Bucharest
- where DIICOT sought custody
- Vaslui county
- one of the search areas in Romania
- Catalonia
- where an earlier attack prompted a separate case
- Greece
- one of the countries where searches occurred
How the source tells it
The piece was a straight police report, built from official statements and carrying no distinct emotive framing.
No emotive framing was found in the original.