On September 30, 2026, police from ten countries dismantled the infrastructure of KillSec, a ransomware group active since 2024. The operation, called KillSwitch, was led by authorities in Hamburg, Germany, with coordination from Europol and Eurojust. Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom, and the United States took part.
Investigators seized five central servers and the leak site where the group published its victims' data, and secured at least 110 terabytes of stolen information.
| Item | Figure |
|---|---|
| Date of the action | September 30, 2026 |
| Participating countries | 10 |
| Arrests | 3 |
| Searches | 8 (Spain, Greece, Romania, and the United Kingdom) |
| Central servers seized | 5 |
| Data secured | At least 110 TB |
| Attacks under investigation | Around 1,000, of which about 500 have been identified as successful |
A note on the numbers. Bitdefender, which supported the investigation, clarifies that the roughly 1,000 attacks cover the entire operation, not just KillSec, and that the figure may change.
A Small Group With Defined Roles
According to Europol, the investigation began in 2025 and found that KillSec had at least four members, each with a distinct function:
- Leader and main administrator
- Developer
- Negotiator, in charge of dealing with victims
- Affiliate
Authorities have not ruled out that the group was larger, and the investigation remains open.
The detail that has drawn the most attention is age. The alleged leader is 16 years old, and the developer had just turned 18, although many of the crimes attributed to him took place while he was still a minor. Europol has not disclosed the minor's identity. Bitdefender noted that the people identified in this case are teenagers.
These are alleged offenders, and there have been no convictions. What the authorities describe looks less like a lone hacker and more like a small criminal company with a division of labor.
Scale of the Attacks
Security firm Group-IB identified at least 274 affected organizations, distributed by country as follows:
| Country | Share of victims |
|---|---|
| United States | 35% |
| India | 17% |
| Brazil, United Kingdom, Australia, and Colombia | 3% each |
The hardest-hit sectors were financial services and healthcare. According to Group-IB, victims included a major insurer, investment firms, and a consumer app with millions of users.
When the Barrier to Entry Nearly Disappears
KillSec operated under a "ransomware-as-a-service" model. The group offered its platform and infrastructure to outside affiliates, who carried out the attacks in exchange for a share of the ransom: 20%, according to Group-IB. Those who joined did not need to build their own tools or master intrusion techniques.
With that setup, a group of just a few people allegedly managed to affect hundreds of organizations around the world. The attackers went after companies with valuable data and exposed or poorly protected infrastructure. Although most targets were small and mid-sized businesses, large companies and government bodies also appeared among the victims.
This does not mean any teenager can attack a major company on their own. It does show that you no longer need years of experience to cause considerable damage, because criminal tools and services are within reach of anyone who knows where to look.
What Organizations Can Do
Basic measures
- Patch systems exposed to the internet; KillSec relied on known vulnerabilities.
- Review cloud configurations: open access, excessive permissions, and default settings.
- Keep backups disconnected from the main network.
- Enable two-step verification on critical services.
These measures are unglamorous, but they are the ones that most effectively block groups like this. The attacker's age does not change the risk: a badly closed door is just as vulnerable to a teenager as to a professional.
Reference: Europol, newsroom
Author: Edu Quijano