Police in Europe and the U.S. have shut down the servers and leak site of the KillSec ransomware group and provisionally arrested three suspects, Hamburg police said on October 1. German investigators identified a 16-year-old as the group’s suspected main operator and link KillSec to about 1,000 suspected attacks worldwide.

The operation, called “KillSwitch,” was led by the Hamburg State Criminal Police Office (LKA) and the Hamburg public prosecutor’s office, with the coordinated action taking place on September 30, according to the police statement. Eight properties were searched in Spain, Greece, the United Kingdom and Romania. Europol summarized the action as three arrests and eight house searches across four European countries.

According to Hamburg police, the 16-year-old is suspected of being KillSec’s main operator and administrator. A suspected developer, who was a minor during some of the alleged offenses, turned 18 in August 2026. Investigators also identified one person in a negotiation role and one in an affiliate role, and inquiries into other possible members are continuing.

Reporting on who was detained, and where, is less clear-cut. The Record reported that Spanish police announced the arrest of a 16-year-old suspected leader in Alicante, carried out by Catalan authorities and the Civil Guard’s cybercrime unit, and, citing Reuters, that he is a Romanian national. The Register noted that Spanish police announced the arrest of a minor but did not publicly link it to the 16-year-old, and that officials confirmed a Romanian national in his twenties was arrested in Romania as a suspected KillSec affiliate. Authorities have not named the teenager.

Servers, domains and 110 TB of data

Five servers, including the group’s main server and several servers used to exfiltrate stolen data, were identified and shut down, police said. Five domains were taken over and now carry a seizure banner, and investigators secured at least 110 terabytes of data. The leak site, where the group published stolen files of victims who did not pay, is now under law enforcement control.

Hamburg police said KillSec has been active since around 2024 and that authorities in several countries began investigating in early 2025. Of the roughly 1,000 suspected attacks, at least 70 were in Germany and 18 had links to Hamburg. About 500 have so far been confirmed as successful. Police cautioned that these figures may change as the seized evidence is analyzed.

How the group operated

Police said the group exploited software vulnerabilities and poorly secured access points, especially cloud storage, to steal sensitive internal data. Victims were then threatened with publication, and if no ransom was paid, the stolen files were posted on the leak site for anyone to download. The police statement says some victims paid large ransoms and that investigators found the group used AI to build and run its infrastructure and to identify targets.

The Record, citing threat intelligence firm Halcyon, described KillSec as offering one of the most affordable ransomware-as-a-service platforms, with a control panel reachable over the Tor network that included chat functions and custom ransomware tools. The Record reported that this let criminals with limited skills run attacks, and that victims spanned healthcare, government, financial services and other sectors.

Authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the U.K. and the U.S. took part, supported by Europol, including its European Cybercrime Centre, and by Eurojust. The security companies Bitdefender and Group-IB assisted the investigation, according to Hamburg police.

Hamburg Interior Senator Andy Grote said the operation sent a signal to anyone who feels safe in the supposed anonymity of the internet. Jan Hieber, head of the Hamburg LKA, described cybercrime as a growing threat and a major challenge for law enforcement.

Why it matters

By the police account, KillSec’s attacks relied on known software flaws and weakly protected entry points, with cloud storage singled out, followed by extortion through a public leak site. For organizations, that puts familiar controls in focus: patching vulnerable software promptly, closing access points that are not needed, and checking that cloud storage cannot be reached without proper authentication.

The ages of the suspects also stand out. Police say the alleged main operator is 16 and that a suspected developer was a minor during part of the alleged offending. The Record’s description of a low-cost platform with ready-made tools shows how a service model can widen the pool of people able to launch extortion attacks.

What to watch

Hamburg police said investigations into further possible members are ongoing and that the attack totals may be revised as the more than 110 terabytes of secured data are analyzed. The authorities have not yet given details of charges or court dates for the three suspects who were provisionally arrested.

The caveats

The suspects have been provisionally arrested and have not been convicted. Attack counts and success figures come from police and are described as preliminary. Details of the Spanish arrest, including the suspect’s location and nationality, come from media reports rather than the German police statement, and reports differ on whether the person detained in Spain is the 16-year-old described as the main operator.

Corrections and tips: email the editor using the address on the Contact page.