Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
5SEP

Police seize KillSec ransomware leak site

2 min read
12:09UTC

A Hamburg-led operation took the KillSec ransomware leak site, seized five core servers and secured at least 110 terabytes of stolen victim data on 30 September.

← Back to Four privileged platforms under live attackJump to analysis ↓
TechnologyAssessed
Key takeaway

Operation KillSwitch took KillSec's leak site and servers and made three provisional arrests.

Police in an operation led by Hamburg's State Criminal Police Office (LKA Hamburg) took control of the KillSec ransomware leak site on 30 September⁠1. The gang used the site to post victims' stolen files and pressure them into paying. Officers secured at least 110 terabytes of stolen victim data and seized five core servers.

Operation KillSwitch ran with Europol and Eurojust, the EU's police and judicial cooperation agencies, and ten countries took part⁠2. Europol says the suspected administrator and main operator of KillSec is a 16-year-old. Separately, officers searched eight homes in Greece, Romania, Spain and the UK and made three provisional arrests.

Investigators link KillSec, active since about 2024, to around 1,000 suspected attacks, about 500 of them successful. The gang got in through software flaws and weakly protected cloud storage. Europol-backed action against the First VPN service in May pulled 33 servers and questioned its administrator in Ukraine.

Deep Analysis

In plain English

KillSec was a ransomware gang. Ransomware criminals break into organisations, steal their files, lock their systems and demand money, threatening to publish the files on a 'leak site' if they are not paid. On 30 September police from 10 countries, led by the state police in Hamburg, Germany, with help from Europol and Eurojust, the EU's police and prosecutor agencies, took over KillSec's leak site and seized its main servers. That stops the gang publishing more stolen files. Police made three arrests and searched homes in four countries, including the UK.

Deep Analysis
Root Causes

Ransomware-as-a-service sells ready-made encryption tools, leak sites and negotiation support, so running an extortion crew no longer needs deep technical skill. That widens the pool of people who can operate one.

Cloud storage left open or weakly protected gives such crews an entry route that needs no exploit at all. Investigators list it alongside software flaws as KillSec's way in.

The leak site is the crew's leverage: it turns stolen data into public pressure on victims to pay. Seizing it removes the threat for current victims even before any prosecution.

What could happen next?
  • Consequence

    Victims listed on KillSec's site lose the immediate threat of publication while police hold the servers.

  • Risk

    Affiliates who used KillSec's tools can move to another ransomware brand and keep the same entry methods.

Sources:Europol
Mentions:Europol →Eurojust →Greece →Romania →Spain →United Kingdom →Hamburg →Poland →First VPN →National Crime Agency →Ukraine →Germany →FBI →Landeskriminalamt Hamburg →KillSec →Group-IB →Bitdefender →LockBit5 →World Leaks →Operation KillSwitch →Operation Cronos →
First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

Europol· 12 Oct 2026
Read original →
Causes and effects
Caused by
Saffron raid takes down First VPN
Europol's May First VPN raid seized servers without arrests; KillSwitch took servers, the leak site and suspects.
Occurred 21 May 2026
Read story →
This Event
Police seize KillSec ransomware leak site
Police took the leak site, the servers and suspects in one operation, rather than infrastructure alone.
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.