International operation against cybercrime group “KillSec”

Hamburg investigative authorities have taken on a central role in an international operation against the cybercrime group “KillSec”. According to the Hamburg police and Europol, control of the group's leak site was taken over on September 30, 2026. The authorities secured at least 110 terabytes of data against further unauthorized access. The platform is said to have been used to threaten organizations with publishing previously stolen data unless they paid a ransom.

The measure took place as part of Operation KillSwitch, an international investigation led by German authorities into around 1,000 suspected cyber attacks worldwide. According to investigators, at least 70 of these cases are linked to Germany. For Hamburg there are currently findings on 18 cases related to the group. The numbers could change as the evidence seized is evaluated.

The focus of the investigation is a 16-year-old who the authorities have identified as the group's suspected main operator. A total of three suspects were provisionally arrested. Investigators also searched eight properties in Greece, Romania, Spain and the United Kingdom. According to Europol, assets and evidence were also seized.

KillSec is said to have been active since around 2024. According to the investigation, the group used vulnerabilities in software and inadequately secured access, especially to cloud storage, to break into IT systems. Sensitive internal data is then said to have been copied to its own servers. Affected organizations were named on a darknet leak site and were put under pressure to publish the data.

According to current information, around 500 of the approximately 1,000 suspected attacks are considered successful. Investigators also revealed that, according to their own findings, the group used artificial intelligence to set up and operate its infrastructure and to identify potential victims.

The Hamburg State Criminal Police Office and the Hamburg Public Prosecutor's Office led the operation. According to the police, investigators identified five relevant servers, including the group's main server and several exfiltration servers, and shut them down. The authorities also took over several domains operated by KillSec and provided them with seizure notices.

Authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom and the United States took part in the investigation. The measures were supported by Europol, Eurojust and the cybersecurity companies Bitdefender and Group-IB. The evaluation of the seized data and devices is ongoing. According to investigators, this would enable further victims, attacks and those involved to be identified.