SecurityReports disagree14 publishers2 min readPublished Updated
Investigators say a 16-year-old ran KillSec, an extortion crew that exploited weakly secured cloud storage
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
The Watch · Security desk
What happened
- Operation KillSwitch, the international investigation that identified the teenager, was led by police and prosecutors in Germany.
- Officers made three provisional arrests and searched eight homes in Greece, Romania, Spain and the United Kingdom.
- Investigators identified suspects acting as KillSec's administrator, developer, negotiator and affiliate.
- Police took over KillSec's dark web leak site on Wednesday, and the group's domains now redirect to a law enforcement seizure notice.
- Over the course of the investigation, police gained control of five core servers KillSec used to manage operations and hold stolen data.
Why it matters
- exposure Authorities know of about 50 more successful attacks than the leak site listed, so an organisation's absence from the site was never proof it had escaped this crew.
- decision The entry route both accounts single out is cloud storage access that owners configure themselves, and SecurityWeek's mention of software flaws keeps patching on the same list.
- capability Leak-site extortion with roughly 500 confirmed victims was within reach of a crew whose suspected administrator is 16 and whose developer was a minor for part of the run.
Authorities are aware of roughly 500 successful KillSec attacks, SecurityWeek reported [16]. Europol's figure for the total is roughly 1,000 suspected attacks [20]. Set against that and Eurojust's almost 1,000 [8], confirmed compromise is about half the attributed total [27]. Police secured at least 110 TB of stolen data [14]. Averaged over the known successful attacks, that is about 220 GB per victim [30].
KillSec's leverage was the threat to publish. "Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download," Eurojust said [5]. "To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments," the agency added [6]. Before the takedown, the leak site listed roughly 450 victims [28].
Eurojust says the group got in by exploiting poorly secured access, particularly access linked to cloud storage [1]. SecurityWeek's account also points to cloud storage, but it lists software flaws alongside weakly protected entry points [4].
Neither agency grades the crew's technical skill. The suspected administrator and main operator is 16 [2]. The developer turned 18 in August [13] and was a minor when some of the alleged offences were committed, Eurojust noted [11]. Members used aliases online and talked through encrypted messaging services [25].
Eurojust lists judicial authorities from nine countries [10]. SecurityWeek lists ten, the same nine plus the Netherlands [12] [24]. Belgium, Germany, Greece and Romania set up a joint investigation team at Eurojust [26]. Europol traced cryptocurrency and put investigators in touch with private-sector partners [23]. SecurityWeek names two firms that supported the operation, Bitdefender and Group-IB [21].
What to watch
- Whether the continuing hunt for other KillSec members produces arrests beyond the three provisional ones made on the action day.
- What the tracing of KillSec's proceeds, including cryptocurrency, turns up: a ransom total, or victims who paid and were never listed.
- Victim notifications drawn from the 110 TB and five servers now in police hands.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Insufficient
- Hype gap+25
- Incentives45
- Confidence76
Perspective Coverage
14 publishers- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
KillSec got into organisations' systems by exploiting poorly secured access, particularly access linked to cloud storage.
ReportedSupportedSource: Eurojust, via Help Net Security6 sources— create a free account to open themView cited source - [2]
A 16-year-old is suspected of being KillSec's administrator and main operator.
ReportedSupportedSource: Eurojust, via Help Net Security4 sources— create a free account to open themView cited source - [3]
KillSec has been active since 2024.
ReportedSupportedSource: Eurojust, via Help Net Security4 sources— create a free account to open themView cited source - [4]
KillSec broke into organisations through software flaws and weakly protected entry points, especially into cloud storage, then copied sensitive internal data to its own infrastructure.
- [5]
"Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download,"
ReportedSupportedSource: Eurojust statement, quoted by Help Net Security4 sources— create a free account to open themView cited source - [6]
"To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments,"
ReportedSupportedSource: Eurojust statement, quoted by Help Net Security4 sources— create a free account to open themView cited source - [7]
Authorities made three provisional arrests and searched eight homes in Greece, Romania, Spain and the UK.
- [8]
Eurojust says KillSec is responsible for almost 1,000 attacks worldwide.
ReportedSupportedSource: Eurojust, via Help Net Security3 sources— create a free account to open themView cited source - [9]
Authorities identified suspects acting as administrator, developer, negotiator and affiliate.
ReportedSupportedSource: Eurojust, via Help Net Security3 sources— create a free account to open themView cited source - [10]
Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States.
ReportedSupportedSource: Help Net Security, citing Eurojust4 sources— create a free account to open themView cited source - [11]
The suspected developer recently turned 18 and was a minor when some of the alleged offences were committed.
ReportedSupportedSource: Eurojust, via Help Net Security3 sources— create a free account to open themView cited source - [12]
Authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK and the US took part in the operation.
- [13]
The suspected developer turned 18 in August.
- [14]
Authorities secured at least 110 terabytes of stolen data.
ReportedSupportedSource: Eurojust, via Help Net Security3 sources— create a free account to open themView cited source - [15]
On Wednesday police took over KillSec's dark web leak site; KillSec's domains now redirect visitors to a law enforcement seizure notice.
- [16]
Authorities are currently aware of roughly 500 successful KillSec attacks.
- [17]
The teen was identified in Operation KillSwitch, an international investigation led by police and prosecutors in Germany.
- [18]
Investigators will examine seized devices and data and trace the group's financial proceeds; the evidence may help identify other victims, attacks and people involved.
ReportedSupportedSource: Eurojust, via Help Net Security3 sources— create a free account to open themView cited source - [19]
The hunt for other possible KillSec members continues.
- [20]
Europol says KillSec is linked to roughly 1,000 suspected attacks worldwide.
ReportedSupportedSource: Europol, via SecurityWeek3 sources— create a free account to open themView cited source - [21]
The operation received support from cybersecurity firms Bitdefender and Group-IB.
- [22]
Over the course of the investigation, police gained control of five core servers, including systems the gang used to manage its operations and hold data stolen from victims.
- [23]
Europol put investigators in touch with private sector partners and provided specialist support to trace cryptocurrency and examine digital evidence.
ReportedSupportedSource: Help Net Security2 sources— create a free account to open themView cited source - [24]
Eurojust's list of participating countries has nine entries; SecurityWeek's has ten, the same nine plus the Netherlands.
- [25]
Group members used aliases online and talked through encrypted messaging services.
- [26]
Authorities from Belgium, Germany, Greece and Romania set up a joint investigation team at Eurojust.
- [27]
Roughly 500 known successful attacks against almost 1,000 attributed attacks puts confirmed compromise at about half the total.
- [28]
Prior to its takedown, the KillSec leak website listed roughly 450 victims.
- [29]
Authorities know of about 50 more successful attacks than the leak site listed.
- [30]
At least 110 TB of stolen data spread over roughly 500 known successful attacks averages about 220 GB per victim.
Sources
14 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comPolice dismantle KillSec ransomware gang allegedly led by 16-year-old
1 article · October 1, 2026
- cyberscoop.comAuthorities seize KillSec extortion group infrastructure, arrest 3 alleged members
1 article · October 1, 2026
- decrypt.coSpanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group
1 article · October 2, 2026
- helpnetsecurity.com16-year-old suspected leader of KillSec ransomware group arrested
1 article · October 1, 2026
- infosecurity-magazine.comPolice Target KillSec Ransomware Group with Arrests and Seizures
1 article · October 2, 2026
- itpro.com16-year-old boy arrested for masterminding KillSec ransomware group
1 article · October 2, 2026
- news.risky.bizRisky Bulletin: Authorities dismantle KillSec group, arrest members across Europe
1 article · October 1, 2026
- Hamburg Police
presseportal.de
1 article · October 1, 2026
- scworld.comTeenager arrested in Spain suspected of leading KillSec ransomware group
1 article · October 1, 2026
- securityaffairs.comOperation KillSwitch: Police Dismantle KillSec Ransomware Group
1 article · October 1, 2026
- securityweek.comPolice Shut Down KillSec Ransomware, Identify Alleged Teen Leader
1 article · October 1, 2026
- thehackernews.comPolice Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
2 articles · October 2, 2026
- therecord.mediaPolice disrupt KillSec ransomware, arrest suspected teenage leader
1 article · October 1, 2026
- Guardia Civil
web.guardiacivil.es
1 article · October 1, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- European Cybercrime CentreFollow
- EuropolFollow
- DIICOTFollow
- Mossos d'EsquadraFollow
- Guardia CivilFollow
- CVE-2025-31161Follow
- Rapid7Follow
- BitdefenderFollow
- Dmitry VolkovFollow
- EurojustFollow
- Federal Bureau of InvestigationFollow
- Group-IBFollow
- HalcyonFollow
- Operation KillSwitchFollow
- KillSecFollow
- Hamburg State Criminal Police OfficeFollow