Spanish police have arrested a 16-year-old Romanian national suspected of being the administrator and main operator of the KillSec ransomware group, in a coordinated European and U.S. investigation into roughly 1,000 suspected cyberattacks. Authorities seized the group’s servers and leak site and secured at least 110 terabytes of stolen data, according to Decrypt.
The teenager was detained in Alicante as part of Operation KillSwitch, an investigation led by the Hamburg State Criminal Police Office and the city’s public prosecutor. Two other suspects in their twenties were also arrested, one in Britain and one in Romania. Investigators have identified a fourth suspect, described as a developer who turned 18 in August, but that person has not been arrested. The suspect was a minor when some of the alleged offenses took place.
The operation involved searches at eight properties across Spain, Greece, Romania and the UK on September 30. Of the approximately 1,000 attacks under investigation, around 500 have so far been identified as successful, Europol said.
Arrests and the U.S. indictment
A separate strand of the investigation concerns Fouad Eltibrizi, a Dutch national living in the UK who allegedly used the online handle “Archduke.” A federal grand jury in Puerto Rico indicted him on September 16 on allegations including conspiracy to access computers without authorization for financial gain, damage protected computers and transmit extortion threats.
Eltibrizi was arrested in the UK during the following fortnight and is being held pending extradition proceedings. The charges carry a maximum sentence of 10 years. The FBI’s San Juan division worked with European authorities on Operation KillSwitch, which resulted in police taking control of KillSec’s leak site.
U.S. prosecutors allege that KillSec posted details of a Puerto Rico breach on its site in March 2025. The post included samples of stolen patient data and a seven-day countdown. After the affected company did not respond, about 180 gigabytes of data were published. The indictment also describes alleged breaches involving organizations in California, Washington state and Louisiana.
In Britain, officers from the Eastern Region Special Operations Unit arrested a 25-year-old suspected of negotiating with victims. The arrest took place at an address in Levenshulme, Manchester. Authorities have identified 28 victim companies in the UK.
How KillSec operated
KillSec has been active since around 2024, Europol said. Investigators believe the group exploited software vulnerabilities and poorly secured access points, particularly those connected to cloud storage, to enter organizations’ systems and copy internal files to infrastructure under its control.
The group then named victims on a dark-web leak site and threatened to publish the stolen material unless a ransom was paid. Where organizations did not pay, files were sometimes made available for free download.
This approach is known as double extortion. In addition to stealing data, attackers encrypt an organization’s servers and demand payment. The threat of publication is intended to pressure victims even if they can restore their systems from backups. Ransom demands were often made in cryptocurrency.
Swiss prosecutors have been investigating alleged attacks on Swiss companies between October 2023 and June 2025 since July 2025. Swiss federal police also said KillSec used double-extortion tactics. Investigators found evidence that the group used artificial intelligence to build and maintain its ransomware infrastructure and to identify potential victims.
Authorities now control five central servers linked to the operation. Domains associated with the group have been redirected to a seizure notice. Europol’s European Cybercrime Centre is supporting the investigation with cryptocurrency tracing and digital-forensics expertise as officers examine seized devices and attempt to follow the group’s criminal proceeds.
Current market picture
Moneyiar market data at the stated times shows a mixed picture among the listed digital assets. Polygon (prev. MATIC), now shown as POL, was trading at $0.1075179612 at 09:29 on October 3, 2026, down 2.82% over 24 hours and 9.29% over seven days.
OriginTrail (TRAC) stood at $0.4562388171 at the same time, up 1.4% over 24 hours and 23.77% over seven days. Propy (PRO) was priced at $0.3623882289 at 02:04 on October 3, down 0.7% over 24 hours but up 4.53% over seven days.
The investigation’s focus on cryptocurrency reflects its use in ransom demands and the authorities’ effort to trace suspected criminal proceeds. The market figures above describe asset prices and percentage moves only; they do not establish any connection between those assets and the KillSec investigation.
