SPANISH police have arrested a 16-year-old in Alicante who investigators identify as KillSec’s suspected administrator and main operator. The arrest on 30 September, with the leak site seized the following day, comes as part of a Europe‑wide operation led by Hamburg police, with Spanish forces Guardia Civil and Mossos d’Esquadra involved. Authorities say the suspect was one of three people taken into custody, and that the other two are in their 20s—one in the United Kingdom and one in Romania.
EU law enforcement and prosecutors from Puerto Rico and the FBI also took part, with extradition proceedings initiated for the UK detainee and other proceedings ongoing in Romania.
Investigators describe KillSec as a ransomware‑style data theft operation that extorted victims by threatening to publish stolen files on a dark‑web leak site unless paid. The group is accused of compromising organisations via exploited vulnerabilities and weak access controls, copying sensitive data toKillSec‑controlled servers, and then listing victims publicly to pressure payment.
The multinational probe reportedly identified about 1,000 suspected attacks worldwide, with around 280 victims confirmed by Spanish authorities. The operation involved eight searches across Spain, Greece, the UK and Romania, the seizure of more than 110 terabytes of data, and the shutdown of five KillSec servers and multiple domain‑linked services.
Prosecutors in Bucharest sought 30 days’ custody for the Romanian suspect; authorities emphasised that all three arrests are provisional and that investigations continue.