European Police Arrest a Suspected 16-Year-Old Behind the KillSec Ransomware Operation
Three arrests, five servers and at least 110 TB of data were seized after investigators linked KillSec to roughly 1,000 suspected attacks.
Key takeaways
- Three people were arrested on 30 September 2026 in Spain, Romania and the UK; all arrests are provisional.
- Police seized the leak site and at least 110 TB of data and shut down five servers, including KillSec's main one.
- Investigators examine about 1,000 suspected attacks, roughly 500 confirmed successful, with more than 280 victims counted in Spain.
European police have taken down the infrastructure of the KillSec ransomware group and arrested three suspects, including a 16-year-old in Spain described as its main administrator. Hamburg police announced the operation on 1 October 2026, a day after the arrests, in a case that again shows how young many of today's cybercriminals are.
What happened
On 30 September, Spain's Guardia Civil and Mossos d'Esquadra detained the 16-year-old in Alicante. Romania's DIICOT detained a 24-year-old after searching four homes in Bucharest and Vaslui county. The UK arrested a man in his twenties, and Puerto Rico has requested his extradition. Hamburg police and prosecutors led the investigation, with the FBI's San Juan office and Puerto Rico prosecutors involved, and searches also took place in Greece. A suspected developer, who turned 18 in August, has been identified but not arrested. Police stress that all arrests are provisional and the suspects are presumed innocent.
Officers took control of KillSec's leak site, secured at least 110 terabytes of data, shut down five servers including the main one, and placed seizure notices on five domains. In Spain they seized computers, phones and cryptocurrency wallets, and an initial analysis found transactions matching ransom payments from some victims. The Romanian suspect faces charges including forming an organised criminal group, illegal computer access and blackmail; prosecutors asked a court to hold him for 30 days.
How KillSec operated
According to Rapid7, KillSec began as a hacktivist group active since at least 2021 and pivoted to ransomware in October 2023. Its KillSecurity 2.0 and 3.0 encryptors lock files, although some attacks relied on data theft alone. In June 2024 the group started offering the ransomware to affiliates, creating the familiar ransomware-as-a-service structure. Investigators identified roles of administrator, developer, negotiator and affiliate. Access came from exploited software vulnerabilities and poorly secured entry points, particularly cloud storage, and members bought stolen access credentials on the dark web. Victims were sent samples of their data as proof, and threatened with sale to other groups. Hamburg police said the group used AI to build infrastructure and identify victims, but gave no detail.
Scale is large. Investigators are examining about 1,000 suspected attacks worldwide, of which roughly 500 are confirmed as successful; Spanish police alone count more than 280 victims. One Catalan organisation was hit in early 2025 with damage close to one million euros. Europol said the group obtained substantial ransom payments.
Why it matters
The arrests fit a trend. In February 2026 Europol announced results from Project Compass, a campaign against The Com, the loose network of mostly young people behind much ransomware and extortion, reporting 30 arrests and the full or partial identification of 179 perpetrators since January 2025. Earlier in 2026 the US extradited Scattered Spider suspect Peter Stokes from Finland after his arrest at 19. The KillSec case adds an even younger alleged administrator and international coordination spanning at least ten countries.
Seizing a leak site and 110 TB of stolen data also gives investigators a map of victims. Police can notify companies that never knew their data was for sale, and match wallet movements to ransom payments, which is how many cases are built.
The involvement of a 16-year-old administrator does not mean the operation was small or unsophisticated; it means the barriers to entry have dropped. Ransomware-as-a-service platforms, purchasable access credentials and cryptocurrency let a few people run an international extortion business from a bedroom. For victims, the lesson is that the attackers' tradecraft often relies on basics: exposed cloud storage and unpatched software. Closing those gaps, monitoring for unexpected large data transfers and keeping tested offline backups still blunt most of this activity.
What to watch
- Extradition and charging decisions, including the UK suspect sought by Puerto Rico and how Spain handles a minor.
- Victim notifications triggered by the seized data, including in healthcare and local government.
- Whether the unarrested developer or affiliates reappear under a new brand, as ransomware crews often do after takedowns.
