Landeskriminalamt Hamburg
Hamburg's State Criminal Police Office.
Hamburg's State Criminal Police Office is the city-state's criminal investigation force; on 30 September 2026 it led Operation KillSwitch, which took over the KillSec ransomware leak site, seized five core servers and secured at least 110 terabytes of stolen data.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How did Hamburg police take down a ransomware gang linked to 1,000 attacks?
Timeline for Landeskriminalamt Hamburg
Led Operation KillSwitch against KillSec
Cybersecurity: Threats and Defences: Police seize KillSec ransomware leak siteBackground
Landeskriminalamt Hamburg (LKA Hamburg) is the criminal investigation office of Hamburg, a city-state and one of Germany's federal states.
Hamburg detectives ran Operation KillSwitch, and on 30 September 2026 their operation seized the leak site KillSec used to shame victims. The LKA worked the case with the Hamburg public prosecutor's office, while Europol and Eurojust coordinated ten participating countries. The haul was five core servers and at least 110 terabytes of stolen victim data. Searches at eight homes across Greece, Romania, Spain and the UK led to three provisional arrests. Europol says KillSec's suspected administrator and main operator is a 16-year-old.
The LKA's investigators tie KillSec, which began operating around 2024, to roughly 1,000 suspected intrusions, of which some 500 succeeded through software flaws and poorly secured cloud storage. KillSwitch took the leak site, the servers and suspects together; Europol's Operation Saffron in May seized 33 servers without naming an arrest.
