Europol announces operation against KillSec ransomware infrastructure
Europol said investigators seized the leak site, provisionally arrested three suspects and secured at least 110 terabytes of data in a case linking KillSec to around 1,000 attacks.
Event / data period: 2026-09-30
Published: · Updated:
Europol said on 1 October 2026 that authorities took control of the KillSec group’s leak site on 30 September in Operation KillSwitch, an investigation led by Germany. The site had been used to threaten victims with publication of stolen files; at least 110 terabytes of data were secured against unauthorised access.
Three people were provisionally arrested and eight properties searched in Greece, Romania, Spain and the United Kingdom. Investigators are examining around 1,000 suspected attacks and have so far identified about 500 as successful; Europol said that figure could change as seized evidence is reviewed.
Data
Security development
Security event or institutional action reported by the source.
- · Occurred
Seizure of KillSec leak site and servers
Authorities took control of the leak site, secured at least 110 terabytes of data, and carried out three provisional arrests and eight searches across four countries.
Methodology
The event date and description summarise the action reported by the source; no additional measurement or forecast is made.
Updated:
Measure reported by the source
Key quantitative figure stated by the source.
- Data secured on leak site
- ≥110 terabytes
- 2026-09-30 · Observed
Methodology
Value is reproduced as stated by the source; a qualifier marks an approximate or bounded figure.
Updated:
Subjects and places
Subject proposals
- Cyber crimeSuggested
- Subject suggested from the title or summary: ransomwarewww.europol.europa.eu ↗