By October 1, visitors to KillSec's leak site found a police banner where the gang's list of victims used to be. Investigators led from Hamburg had taken over the site the day before and, over the course of the inquiry, the servers behind it. They locked down at least 110 terabytes of data stolen from victims, arrested three people and searched eight properties in Spain, Greece, Romania and the United Kingdom.
The most striking line in the announcements from Hamburg police, Europol and Eurojust concerns who they believe ran it. The suspect they describe as administrator and main operator of a group linked to roughly 1,000 attacks worldwide is 16 years old. A second suspect, the group's developer, only reached 18 in August, and some of the alleged offences date from when he was a minor.
Who was arrested where
Officers from the Guardia Civil and the Catalan police, the Mossos d'Esquadra, detained the teenager in Alicante, searched a home and a hotel office in the province, and seized computers, phones and cryptocurrency wallets. Spanish police said he is a Romanian national and that a first look at the wallets showed transactions matching ransom payments. The Guardia Civil's case dates from 2025 and grew out of cooperation with the FBI in San Juan, Puerto Rico; investigators say they traced the suspect from a single profile picture.
The other two arrests were of men in their twenties. One was detained in the United Kingdom, a Dutch national who US prosecutors say was indicted by a federal grand jury in Puerto Rico on September 16 for conspiracy to gain unauthorized access to computers, and who is awaiting extradition. The other was picked up in Romania, where the organized crime directorate DIICOT said it detained a 24 year old man on September 30, searched four homes in Bucharest and in Vaslui county, and asked a Bucharest court to hold him for 30 days. Neither Hamburg police nor DIICOT have said which roles the two men are suspected of holding. Police have identified the developer but have not arrested him, and say inquiries into further members continue.
A thousand attacks, half of them confirmed
The scale of the damage depends on how it is counted. Eurojust puts the group's tally at almost 1,000 attacks worldwide since 2024. Hamburg police, which led the operation together with the city's public prosecutor, use the same figure for suspected attacks but say about 500 have so far been confirmed as successful, with at least 70 cases tied to Germany and 18 to Hamburg. Hamburg police caution that the numbers may change as the seized devices are examined, and Eurojust expects the evidence to point to further victims. Group-IB, one of two security firms that supported the inquiry alongside Bitdefender, counted 274 organizations named on the leak site, about 35 percent of them in the United States and 17 percent in India, with financial services and healthcare the sectors hit hardest.
How KillSec worked
In the agencies' account, KillSec reads less like a ransomware operation than a data theft business with a ransomware badge. According to Hamburg police, the group broke into organizations through software flaws and badly protected entry points, above all cloud storage, copied internal data to its own servers, and then named victims on its dark web site with a threat to publish unless they paid. Those who refused saw their files offered for free download, and victims received samples of the stolen files to prove the gang held them. Romanian prosecutors add that members bought access credentials on dark web markets and threatened to sell data on to other criminal groups. In some cases, the agencies say, the ransoms paid were substantial.
Group-IB's reconstruction fills in the business model. The group ran its affiliates through a Tor based panel, charging a USD 250 entry fee and taking a 12 percent cut of each ransom when the firm first analyzed the platform in October 2024, later raising its share to 20 percent. In November 2024 it added a locker for VMware ESXi hosts that could shut down virtual machines, delete snapshots and wipe logs. It sold stolen data as well, at asking prices that ran from USD 5,000 for one company's files up to USD 500,000 for what it claimed was a global insurer's data. A large share of its claimed victims, the firm says, involved no intrusion at all, only data lifted from cloud storage left open through misconfiguration. Investigators also found that KillSec relied on AI to construct and operate its infrastructure and to choose targets.
What the police took matters as much as whom. The state criminal police office in Hamburg identified and shut down five servers, among them the gang's main machine and a number of others that stored exfiltrated data, and placed seizure banners on five domains. Eurojust ran the action day from a coordination centre at its headquarters, with a joint investigation team of Belgian, German, Greek and Romanian authorities and, according to Hamburg police, participants from ten countries in all. The next phase is slower: working through 110 terabytes of other people's data to find victims who never knew they were on the list, and following the money through the seized cryptocurrency wallets.
