Teenager accused of running KillSec ransomware gang arrested as police seize servers

Key points

• Europol says a teenager is suspected of leading KillSec, a ransomware crew linked to roughly 1,000 attacks worldwide, with three arrests and eight searches across four European countries.
• Police seized the group's servers and its public leak site, where victims were named and shamed into paying.
• Ransomware is malicious software that scrambles a company's files until the victim pays for the decryption key.
• Our first story on KillSec, published 1 October 2026, identified the alleged ringleader as a Romanian teenager following a year-long investigation.
• If your organisation was ever listed on the KillSec leak site, law enforcement likely now holds a copy of whatever was stolen.

A teenager is accused of running one of the busier ransomware gangs on the internet, and European police say they've now pulled the plug on it.

Europol said this week that officers made three arrests and carried out eight searches across four European countries in an operation against KillSec. Investigators link the crew to around 1,000 attacks worldwide. The main suspect is a minor.

Alongside the arrests, police seized the servers KillSec used to run its operation and the leak site where it published stolen files to pressure victims into paying.

Who are KillSec?

KillSec is a ransomware gang: criminals who break into company networks, scramble files with malicious software, and demand money to restore them. They also steal data on the way out and threaten to publish it.

The group ran what the industry calls a leak site, a dark-web page where victims who refused to pay were named and had samples of their stolen data posted as proof.

In practice, KillSec sat in the second tier of ransomware brands. Not as loud as LockBit or ALPHV at their peak, but steady, posting new claimed victims most weeks through 2024 and into 2025. Those are claims the criminals made, not confirmed breaches, and we're not naming individual companies from that data.

What did the police actually do?

Europol coordinated the operation. Officers in four countries moved simultaneously, made three arrests, and searched eight addresses. They also took control of the group's back-end servers and the leak site itself.

Taking the servers matters more than the arrests alone. The servers hold chat logs, victim lists, payment records and, in some cases, the keys needed to restore scrambled files. That material turns a press release into actual prosecutions, and sometimes into free decryptors for victims.

Europol hasn't yet published technical detail on what was recovered, or named the suspects, which is standard practice where a minor is involved.

What should ordinary people do?

For most people, nothing changes today. If your employer was hit by KillSec in the past year, you may hear from them again as police work through the seized data. Victims sometimes only learn the full scope of what was stolen months later.

If a company told you your details were taken, watch your bank statements and be wary of emails that reference real information about you. Criminals often recycle stolen data into phishing attempts, fake messages designed to trick you into handing over passwords or card details.

Should you worry about the group coming back?

Takedowns of this size rarely kill a brand outright. Affiliates, the people who actually run the intrusions, tend to resurface under a new name within months. What a server seizure does buy is a window: a few weeks where the group's infrastructure is down, its reputation on criminal forums is shaky, and investigators are reading its chat history.

That's worth doing. It isn't the end of ransomware.

Organisations that appeared on the KillSec leak site should brief their legal and communications teams now. Law enforcement's copy of the seized data will eventually feed court proceedings, and those proceedings surface details companies would rather manage on their own timeline.