Cybersecurity
Police seize KillSec sites and arrest three suspects
German-led authorities and partners seized KillSec’s leak site and servers, arrested three suspects and identified a 16-year-old as the alleged main operator in a probe begun in 2025.
- Europol said Operation KillSwitch was an international investigation led by German authorities into about 1,000 suspected attacks worldwide.
- Authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland and the United Kingdom took part, along with Europol, Eurojust, Bitdefender and Group-IB.
- Investigators said they provisionally arrested three suspects, searched eight properties in Greece, Romania, Spain and the United Kingdom, and seized at least 110 terabytes of data.
- Europol said investigators had identified a 16-year-old as the suspected main operator, and another suspect turned 18 in August 2026 after allegedly acting as a developer.
- Authorities said they had linked around 500 successful attacks to KillSec, including at least 70 in Germany and 18 in Hamburg.
On 30 September, law enforcement seized KillSec’s data leak site and servers and carried out arrests during the operation. Europol said the action involved authorities from several countries and had been led by German investigators.
Europol said the case had started in 2025 and related to about 1,000 suspected attacks. Investigators said they had identified people believed to have been an administrator, a developer, a negotiator and an affiliate.
Hamburg Police said it examined the group’s server infrastructure and shut down five servers, including the main server and others said to have held stolen data. The seized site now carries a notice saying the domain, servers and related data were taken over by the State Criminal Police Office of Hamburg and international law enforcement.
Authorities said they had taken at least 110 terabytes of stolen data and were trying to trace the group’s alleged proceeds, including cryptocurrency. Europol said the group had received substantial ransom payments, and investigators said members had used artificial intelligence to help build and maintain the infrastructure and to identify possible victims.
Named in this story
Companies
- Bitdefender
- took part in the investigation
- Group-IB
- took part in the investigation
Organisations
- Operation KillSwitch
- was the law-enforcement operation that led to the seizures and arrests
- KillSec
- was the ransomware group whose site and servers were taken over
- Europol
- said the operation covered about 1,000 suspected attacks and gave the investigation details
- Eurojust
- took part in the investigation
Governments and agencies
- Hamburg Police
- investigated the group’s server infrastructure
- State Criminal Police Office of Hamburg
- said it had taken control of the domain and associated data
Places
- Germany
- was where German authorities led the investigation and where 70 suspected attacks were linked
- Greece
- was one of the countries where searches were carried out
- Romania
- was one of the countries where searches were carried out
- Spain
- was one of the countries where searches were carried out
- United Kingdom
- was one of the countries where searches were carried out
- Hamburg
- was linked to 18 suspected cases
How the source tells it
A restrained law-enforcement report that mostly relayed official findings and counts.
No emotive framing was found in the original.