Overview
- Investigators led by LKA Hamburg executed Operation KillSwitch and on Wednesday took control of KillSec’s Darknet leak site, seized five central servers and secured more than 110 terabytes of data.
- Authorities provisionally arrested three people, including an alleged 16-year-old administrator and an individual who turned 18 in August, and searched eight locations in Greece, Romania, Spain and the UK.
- Police say KillSec, active since about 2024, exploited software flaws and poorly secured cloud storage to copy sensitive data and extort organizations through a hack-and-leak model.
- Investigators report roughly 1,000 suspected attacks attributed to the group with about 500 currently classed as successful and at least 70 linked to Germany, but they stress these totals are provisional pending forensic analysis.
- Europol, Eurojust and private cyber firms are supporting a cross-border forensic review that could expand the list of victims and lead to further arrests or asset seizures.