European police seize KillSec leak site, identify 16-year-old as suspected leader

October 1, 2026 at 06:58 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

European authorities seized the KillSec ransomware group's dark web leak site and secured at least 110 terabytes of stolen data. A 16-year-old is suspected of being the group's administrator and main operator, with three other suspects arrested in an operation spanning four countries. The takedown follows roughly 1,000 suspected attacks worldwide attributed to the group since 2024.

Key Facts

European authorities seized KillSec's dark web leak site and blocked access to at least 110 terabytes of data, according to Europol.
A 16-year-old is suspected of being the administrator and main operator of KillSec, identified in Operation KillSwitch led by German police and prosecutors.
Three suspects were arrested and eight properties were searched in Greece, Romania, Spain, and the United Kingdom.
KillSec has been linked to roughly 1,000 suspected attacks worldwide since becoming active around 2024.
Police also gained control of five core servers used by the gang to manage operations and hold stolen data.

Operation KillSwitch

The international investigation, named Operation KillSwitch, was led by police and prosecutors in Germany. Authorities made three provisional arrests and searched eight homes in Greece, Romania, Spain, and the United Kingdom. Investigators identified a suspected developer who turned 18 in August and was a minor when some alleged offences were committed. One person is believed to have acted as a negotiator and another as an affiliate, according to Europol. The hunt for other possible members continues, Europol said.

Ransomware Operations

KillSec became active around 2024, exploiting software flaws and weakly protected entry points, especially into cloud storage. The group stole data, copied it to its own infrastructure, and threatened to publish the files unless victims paid a ransom. Victims who refused to pay could see their stolen files offered as free downloads on the dark web leak site. In some cases, the group received substantial ransom payments, Eurojust said. Group members used aliases online and communicated through encrypted messaging services to hide their identities.

Seizure and Aftermath

On Wednesday, police took over KillSec's dark web leak site and blocked further unauthorized access to at least 110 terabytes of data. KillSec's domains now redirect visitors to a law enforcement seizure notice. Law enforcement also gained control of five core servers, including systems used to manage operations and hold stolen data. Authorities investigated the group's finances and criminal proceeds as part of the operation.