An international law enforcement operation called Operation KillSwitch has taken down the KillSec ransomware group’s infrastructure. On September 30, authorities in Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom, supported by Europol and Eurojust, seized the group’s dark web leak site and five servers, including its main server and several used to store stolen data. Eight properties were searched in Greece, Romania, Spain, and the United Kingdom, and three suspects were provisionally arrested.
Europol says the alleged administrator and main operator is a 16-year-old. A second suspect, described as a developer, turned 18 in August 2026 and was still a minor when some of the alleged crimes took place; investigators also identified a suspected negotiator and an affiliate. The investigation, led by German authorities, covers around 1,000 suspected attacks since KillSec appeared in 2024, of which roughly 500 appear to have succeeded and at least 70 hit German organizations. KillSec is accused of breaching companies through software vulnerabilities and poorly secured edge devices, stealing data, and threatening to publish it unless a ransom was paid. Europol says the group received “substantial” payments and that members used AI tools to help build their infrastructure and pick victims. Authorities seized at least 110 terabytes of stolen data and are now analyzing the evidence, which could reveal more victims.