KillSec operation: three arrests and 110 terabytes secured
Investigators identified a 16-year-old as KillSec’s suspected main administrator. On 1 October, Europol and Eurojust reported three arrests and eight searches in four countries.
The cybercrime operation was called KillSwitch. Searches took place in Greece, Romania, Spain and the United Kingdom. Investigators took control of five servers and secured at least 110 terabytes of stolen data. Domains used by the group also came under official control. Police and prosecutors in Hamburg led the investigation.
According to investigators, KillSec had operated since around 2024. The group exploited weak security to enter computer systems, including cloud storage, and copied internal files. Organisations then faced demands for payment to prevent publication. Investigators identified roles including administrator, developer and negotiator. A suspected developer had recently turned 18.
The international investigation covered approximately a thousand suspected attacks. Authorities are examining seized equipment and financial flows to identify other participants and victims. Eurojust coordinated judicial cooperation, while Europol supported digital evidence and cryptocurrency analysis.









































