Europol: Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site

• Europol states that investigators identified a 16-year-old as KillSec’s suspected main operator during Operation KillSwitch, which targeted around 1 000 attacks worldwide.
• Europol confirms three provisional arrests and eight property searches in Greece, Romania, Spain, and the United Kingdom on 30 September 2026.

On 30 September 2026, law enforcement agencies seized KillSec’s leak site, securing at least 110 terabytes of stolen data and taking control of five central servers used by the group. The action was part of Operation KillSwitch, an international investigation led by German authorities and supported by Europol, Eurojust, and private cybersecurity firms.

Investigators identified a 16-year-old as the suspected main operator of KillSec, provisionally arrested three suspects, and searched eight properties across Greece, Romania, Spain, and the United Kingdom. Authorities are now examining seized devices and tracing criminal proceeds, including cryptocurrency, to identify further victims and attacks.

• 110 terabytes data secured from KillSec leak site
• 1 000 suspected attacks worldwide
• 16 age of suspected main operator

• Review internal systems for vulnerabilities and poorly secured access points exploited by KillSec, as described in Europol’s Operation KillSwitch.
• Check for exposure of sensitive data on KillSec’s leak site, which was seized and contained at least 110 terabytes of stolen files.
• Monitor for ransom demands and threats linked to KillSec’s activities, especially if your organisation was named among the around 1 000 suspected attacks.

This story highlights the evolving threat posed by ransomware groups like KillSec, which exploited vulnerabilities and used AI to target organisations. The seizure of their infrastructure and data, including 110 terabytes of stolen files, demonstrates the importance of international cooperation and robust cyber hygiene. Compliance officers must be vigilant for signs of compromise, ransom demands, and exposure on dark web leak sites, as law enforcement actions may reveal new victims and typologies relevant to AML/CFT risk assessments.