# Spanish Authorities Arrest Teen Suspected of Running KillSec Ransomware Group

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/26340
Published: 2026-10-02T09:25:29.000Z
Updated: 2026-10-02T09:25:29.000Z
Section: Technology

> The operation secured at least 110 terabytes of data and brought five central servers under police control. Investigators linked the group to about 1,000 suspected attacks.

Spanish authorities arrested a 16-year-old suspected of operating the KillSec ransomware group in an international operation that secured at least 110 terabytes of data and brought five central servers under police control.

The Romanian national was arrested in Alicante on Sept. 30. Authorities provisionally arrested two other suspects and searched eight properties in Greece, Romania, Spain and the United Kingdom. German authorities led the operation, which also took control of KillSec’s leak site.

Investigators linked the group to about 1,000 suspected attacks worldwide, with about 500 identified as successful so far. That count may change as authorities examine seized devices and data, which could help identify additional victims and participants.

KillSec has been active since around 2024. Europol said the group exploited software vulnerabilities and poorly secured access points, including those connected to cloud storage, to steal sensitive files. The group threatened to publish stolen data unless victims paid; in some cases, it made the files available for download.

A separate federal case in Puerto Rico involves Fouad Eltibrizi, a Dutch national who lives in the United Kingdom. A federal grand jury indicted him on Sept. 16, and he was arrested in the U.K. on Sept. 30 pending extradition. The indictment alleges that Eltibrizi and co-conspirators targeted victims from at least March through November 2025.

In one alleged case, a Puerto Rico victim did not pay KillSec’s ransom demand after a seven-day countdown. The group then published about 180 gigabytes of stolen data, including samples of patient data. Eltibrizi faces a maximum sentence of 10 years in prison if convicted.

“Ransomware remains a serious and evolving threat to all sectors of our economy, from critical infrastructure to small businesses,” said Héctor Ramírez-Carbó, acting U.S. attorney for the District of Puerto Rico.