Arrest in Alicante in the International Operation Against KillSec

The activity attributed to KillSec dates back to approximately 2024. In Spain, the investigation began in 2025 following a cyberattack provisionally attributed to the group against a Catalan organization. The international operational phase took place on September 30, 2026 and concluded with three arrests, including that of a 16-year-old in Alicante suspected of acting as the group's administrator and main operator.

Authorities link KillSec to more than 1,000 cyberattacks, around 500 of which were successful, affecting more than 280 victims. The group allegedly accessed systems, particularly cloud storage environments, to copy information and demand ransom payments under threat of publication. Eight searches in four countries resulted in the seizure of evidence and assets, the takeover of five servers and several domains, and the securing of at least 110 terabytes of stolen data.

The latest official status indicates that KillSec's infrastructure and leak site are under the control of the authorities. The investigation continues through the examination of seized devices and data and the tracing of possible financial proceeds, with the aim of identifying further victims, attacks and individuals involved. Authorities have not announced that the full extent of the activity or the specific involvement of all suspects has been determined.