Europol Dismantles KillSec Ransomware Group, Arrests 16-Year-Old Alleged Leader in Spain

European law enforcement agencies have dismantled KillSec, a ransomware and data-extortion operation linked to approximately 1,000 attacks worldwide, in a coordinated takedown announced on October 1. Operation KillSwitch involved Europol, Eurojust, and cybersecurity firms Bitdefender and Group-IB, with raids conducted across Spain, Greece, Romania and the United Kingdom.

The most significant arrest was a 16-year-old Romanian national living in Alicante, Spain, identified as KillSec's main administrator. Spanish Guardia Civil and Catalan police detained the suspect on September 30. Two additional suspects were arrested in connected raids. Under Spanish child privacy laws, the teenager's name has not been released.

Investigators seized five central servers, took control of the group's dark-web leak site, secured at least 110 terabytes of stolen data, and redirected five associated domains to police seizure notices. German authorities in Hamburg separately identified and shut down the main server infrastructure. Europol described KillSec as a significant ransomware-as-a-service operation that offered its tools to affiliates.

The age of the alleged ringleader underscores a recurring pattern in cybercrime: sophisticated operations increasingly run by very young individuals. For organisations that were victims, the recovery of 110 terabytes of exfiltrated data may provide some avenue for assessing what was compromised. The takedown is the latest in a series of major ransomware disruptions by European law enforcement in 2026.