Operation KillSwitch takes down KillSec; its alleged leader is 16
Police from ten countries, Spain among them, seized the KillSec ransomware leak site on 30 September, with three arrests and eight searches in Spain, Greece, Romania and the UK. Five central servers and at least 110 TB of stolen data were secured. Active since 2024, the group claimed around 1,000 attacks, about 500 of them confirmed.
110 TB
of stolen data secured
What happened
On 30 September, police from ten countries —Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK and the US— took control of KillSec's leak site, coordinated by Europol. The operation, called KillSwitch, led to three arrests, eight searches in Spain, Greece, Romania and the UK, and five central servers seized.
According to investigators, the alleged leader is 16 years old. Those arrested also include a Dutch national detained in the UK and awaiting extradition to the US, and an alleged developer who turned 18 in August.
How KillSec operated
Active since 2024, KillSec ran as ransomware-as-a-service: it rented its infrastructure to other criminals, who broke into networks and cloud environments, stole data and threatened to publish it unless paid. Around 1,000 attacks are attributed to it, about 500 of them confirmed. Officers secured at least 110 TB of stolen data to stop it spreading further.
What it means for your company
Taking down a group doesn't make what it stole disappear: data that was already published keeps circulating, and other groups fill the gap within weeks. The alleged leader's age says a lot about the moment: running an extortion operation no longer takes big resources, just rented tools and stolen credentials to get in.
If your organisation had an incident involving this group, it is worth checking which of your data is still circulating and changing any credential that might be in it.