Thought Leadership
Police have taken control of KillSec’s leak site, preventing further extortion attempts involving stolen data. The Hamburg State Criminal Police Office coordinated the operation.
Police have arrested three suspects, including a 16-year-old, in an international operation targeting a ransomware group. According to Hamburg police, authorities also searched eight locations in Greece, Romania, Spain and the United Kingdom. Servers, endpoint devices, data and assets were seized during the searches.
Around 1,000 Suspected Cyberattacks
According to authorities, the operation was carried out as part of “Operation KillSwitch,” an international investigation led by German authorities into around 1,000 suspected cyberattacks worldwide. At least 70 of the attacks occurred in Germany, with 18 currently linked to Hamburg.
On Wednesday, law enforcement agencies took control of the KillSec cybercrime group’s leak site and secured at least 110 terabytes of data against unauthorized access, authorities said. Investigators believe the group used the site to threaten organizations with the publication of previously stolen data unless they paid a ransom. In some cases, substantial sums of money were reportedly paid.
Group Used AI
The group also used AI to build and operate its ransomware infrastructure and identify potential victims. So far, investigators have identified around 500 suspected successful attacks. The investigation has been ongoing since early 2025.
Authorities identified a 16-year-old as the suspected administrator and primary operator of the group, which has been active since around 2024. A suspected developer turned 18 in August. Investigators also identified one person in a negotiation role and another acting as a partner in the group’s distribution network.
Hamburg State Criminal Police Office Led KillSec Operation
The operation against KillSec was led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor’s Office. Authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom and the United States were involved. Europol and Eurojust also participated in the investigation.
“Following Operation Medusa targeting sexualized violence against sedated individuals, the international strike against the KillSec group is already the second international operation within just a few months in which the Hamburg State Criminal Police Office has played a key role,” said Hamburg Interior Senator Andy Grote (SPD). The operation also sends a message to anyone “who feels safe in the apparent anonymity of the internet while committing serious crimes.”
(dpa/Translation: Editorial Team)
