Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Leak Site

What it is

Three arrests in the KillSec takedown: a 16-year-old in Alicante, Spain (suspected main administrator), a man in his 20s in the U.K., and a 24-year-old in Romania. A fourth suspect, the alleged developer (18 in August, a minor during some offenses), was identified but not arrested. The operation was led by Hamburg police and prosecutors, with Guardia Civil, Mossos d'Esquadra, DIICOT (Romania), Europol, Eurojust, the FBI's San Juan office, and U.S. prosecutors in Puerto Rico involved. Puerto Rico has filed an extradition request for the U.K. suspect.

How it works

Investigators mapped KillSec to four roles: administrator, developer, negotiator, and affiliate (an outside partner using the group's ransomware tools). The Guardia Civil investigation started in 2025 from FBI San Juan cooperation and traced the Alicante suspect from a single profile image. The Mossos d'Esquadra opened a separate case after a KillSec attack on a Catalan organization in early 2025 that caused close to €1 million in damage. DIICOT alleges the Romanian suspect's group also bought access credentials sold on the dark web and sent victims data samples as proof before threatening to sell data to other criminals if unpaid.

Preconditions / Affected

The investigation covers roughly 1,000 suspected attacks, with about 500 confirmed successful so far (both figures may grow). Investigators seized 110+ TB of data, shut down five servers (including KillSec's main server and data-hosting servers), seized five domains, and recovered crypto wallets with transactions matching ransom payments. The Romanian suspect faces charges including forming an organized criminal group, illegal computer access, unauthorized data transfer, illegal device/software operations, and blackmail; a Bucharest court was asked to hold him 30 days pending investigation (presumed innocent, as are all three arrestees — arrests are "provisional").

What to do

No patch or defensive action is specified in the page; this is a law-enforcement status update, not a vulnerability advisory. Organizations previously breached by KillSec (via software vulnerabilities or poorly secured cloud storage) should note the investigation may surface additional victims as seized evidence (110TB) is processed, and that leaked/stolen data may still exist on seized infrastructure now under police control rather than public exposure.

Caveats

The suspected developer remains at large. Roles of the U.K. and Romanian arrestees were not disclosed by Hamburg police or DIICOT. The 500/1,000 attack figures are explicitly provisional and may change. Investigators gave no technical detail on the stated AI use for "building infrastructure and identifying targets" beyond the bare claim.