Europol: KillSec ransomware group disrupted, suspected leader is 16

Europol announced on 1 October 2026 the results of Operation KillSwitch, an international investigation headed by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor's Office into around 1,000 suspected attacks by the KillSec group. On 30 September, authorities took control of the group's leak site, securing at least 110 terabytes of data. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain and the United Kingdom.

According to Europol, KillSec has been active since around 2024. It entered organizations' systems through software vulnerabilities and poorly secured access points, especially to cloud storage, copied internal data, then named victims on its dark web leak site and threatened to publish the files unless paid. About 500 of the suspected attacks have so far been identified as successful. Investigators also found that the group used AI to build its infrastructure and identify potential victims.

Europol says the suspected administrator and main operator is 16 years old, and a suspected developer turned 18 in August 2026. Five central servers were brought under police control during the investigation, which Eurojust coordinated on the judicial side.

Why it matters The case shows how far a group run by teenagers can reach once AI handles part of the tooling and the choice of victims. The entry points described are ordinary ones, unpatched software and poorly secured cloud storage, and securing a leak site does not guarantee that no other copy of the stolen data exists.