- Spanish police arrested a 16-year-old Romanian national in Alicante, suspected of being the administrator of the KillSec Ransomware group.
- A Dutch national living in the UK has been indicted in Puerto Rico and arrested pending extradition for conspiracy to access computers without authorization.
- Investigators are tracing the group’s criminal proceeds, including cryptocurrency, as part of the international operation.
Spanish police arrested a 16-year-old Romanian national in Alicante, suspected of being the main operator of the KillSec ransomware group, Europol said. Law enforcement across Europe seized its servers and leak site, securing at least 110 terabytes of stolen data.
The teenager is suspected of acting as the group’s administrator, a Europol spokesperson Hacker-group-europe-wide-probe-2026-10-01/” target=”_blank”>told Reuters. Two other people in their twenties were arrested, one in Britain and one in Romania.
The September 30 action was part of Operation KillSwitch, an investigation led by the Hamburg State Criminal Police Office into about 1,000 suspected attacks worldwide. Eight properties were searched in Spain, Greece, Romania and the UK.
A Dutch national resident in the UK, Fouad Eltibrizi, was indicted by a federal grand jury in Puerto Rico on September 16 over conspiracy to access computers without authorization. He was arrested and faces extradition with a maximum penalty of 10 years.
U.S. prosecutors say KillSec posted a Puerto Rico breach on its leak site in March 2025 with samples of stolen patient data. When the company did not respond, roughly 180GB were published.
KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured access points to reach organizations’ systems. The group used double extortion, encrypting servers and threatening to publish data if a company declined to pay, Switzerland‘s federal police said.
Ransoms were often demanded in cryptocurrency. Investigators also found the group had used AI to build and maintain its ransomware infrastructure.
Five central servers are now under police control, along with domains redirected to a seizure notice. In the UK, officers from the Eastern Region Special Operations Unit arrested a 25-year-old suspected of negotiating with victims.
Ransomware causes “significant financial losses, operational disruption and harm to public confidence,” Detective Sergeant John Collinson said. Investigators are tracing the group’s cryptocurrency proceeds.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
