Operation KillSwitch
Hamburg-led 2026 police operation that seized the KillSec ransomware leak site and servers.
Police in Operation KillSwitch seized control of KillSec's leak site on 30 September 2026, taking five core servers and at least 110 terabytes of stolen data. Europol says the gang's suspected main operator is 16 years old.
Last refreshed: 12 October 2026
How did a 16-year-old allegedly run a ransomware gang?
Timeline for Operation KillSwitch
Named as Operation KillSwitch
Cybersecurity: Threats and Defences: Mentioned in: Police seize KillSec ransomware leak siteBackground
Operation KillSwitch was a German-led police action against the KillSec ransomware gang, run by Hamburg's state police with Europol and Eurojust coordinating. Ten countries joined: Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK and the US.
On 30 September 2026 KillSwitch brought down KillSec's public leak site. Its haul was five core servers and no less than 110 terabytes of data stolen from victims. Officers made three provisional arrests after searches of eight properties spread over Greece, Romania, Spain and the UK. Europol identified a 16-year-old as KillSec's suspected main operator.
KillSwitch investigators are now working through about 1,000 suspected KillSec attacks dating from roughly 2024, of which about 500 are confirmed as successful.