Overview
- German-led investigators took control of KillSec’s public leak site on 30 September, identified and disabled five central servers, and secured at least 110 terabytes of data to prevent further public releases.
- Police provisionally detained three suspects after searches in Greece, Romania, Spain and the United Kingdom, and investigators have identified an alleged 16-year-old as the group’s main operator.
- Authorities currently attribute roughly 1,000 alleged attacks to KillSec, about 500 of which are considered successful, with at least 70 cases tied to Germany and 18 to Hamburg; those figures remain provisional as evidence is reviewed.
- Investigators say KillSec used software vulnerabilities and poorly secured cloud storage to copy internal data, ran a leak site to extort victims, and employed artificial intelligence to help build infrastructure and find targets.
- The operation involved Europol, Eurojust and private cyber firms and officials warn that forensic analysis of seized servers and devices could identify more victims, attacks and collaborators in the coming weeks.