Skip to content
HACKTECH
Ransomware & extortionReported Published 4 sources

Eurojust and Europol action on KillSec extortion group: three arrests, servers seized

Eurojust and Europol announced on 1 October 2026 an international action against the KillSec data-extortion group, part of a German-led investigation that Europol named Operation KillSwitch. Three suspects were provisionally arrested and eight house searches were carried out in Spain, Greece, the United Kingdom and Romania; investigators identified a 16-year-old as the group's suspected main operator, and CyberScoop reported that the alleged leader was among those arrested. Authorities seized five servers and KillSec-operated domains, took control of its leak site and secured at least 110 terabytes of data. Eurojust linked the group, active since 2024, to almost 1,000 attacks worldwide, of which Europol said around 500 have so far been identified as successful.

  • KillSec
  • Operation KillSwitch
  • Eurojust
  • Europol
  • law enforcement
  • data extortion
  • cloud storage

What the sources report

  • Eurojust said it coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States, with a joint investigation team set up between Belgium, Germany, Greece and Romania; Europol's list of participating authorities also includes the Netherlands.
  • Europol said the operation was led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor's Office, that the alleged administrator and main operator is 16 years old, and that a suspected developer turned 18 in August 2026 and was a minor when some of the offences were committed.
  • Europol said law enforcement took control of KillSec's leak site on 30 September 2026; over the course of the investigation five central servers were brought under police control, KillSec domains were redirected to a seizure notice, and at least 110 terabytes of data were secured.
  • Eurojust said KillSec gained entry 'by exploiting poorly secured access points, particularly those linked to cloud storage', sent victims data samples as proof, and made stolen files available for free download when victims did not pay; Europol said the group also exploited software vulnerabilities.
  • CyberScoop reported that an alleged negotiator arrested in the UK was indicted in Puerto Rico on an unauthorised computer access conspiracy charge, with prosecutors alleging participation from at least March through November 2025.

What it means for your organisation

Seizing the leak site does not recall copies already downloaded, so organisations the group listed should still treat that data as exposed. For a defender, the way in that Eurojust describes points first to storage reachable from the internet, the keys and credentials that guard it, and whether bulk downloads from it raise an alert.

What we check

  • Enumerate internet-reachable cloud storage, file shares and databases and test them for public access or weak credentials.
  • Review access keys, shared links and service accounts tied to storage for scope, age and rotation.
  • Confirm that bulk reads and downloads from storage raise alerts that someone reviews.
  • Check retention so old exports and backups are not left in reachable storage.
  • Check that the incident playbook covers validating extortion data samples and assessing notification duties.

Sources

Services that cover these checks

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works