Spanish police arrested a 16-year-old Romanian national in Alicante suspected of administering and operating the KillSec ransomware group, as authorities in Europe and the United States disrupted its infrastructure. The September 30 action, known as Operation KillSwitch, involved searches at eight properties in Spain, Greece, Romania and the UK and secured at least 110 terabytes of stolen data. Investigators have identified around 1,000 suspected attacks worldwide, including about 500 considered successful so far. Two other people in their twenties were arrested in Britain and Romania, while a developer who turned 18 in August has been identified but not arrested. Fouad Eltibrizi, a Dutch national resident in the UK who used the handle Archduke, was indicted in Puerto Rico on September 16 and arrested within the following fortnight pending extradition to the United States. He faces a maximum penalty of 10 years. KillSec, active since around 2024, allegedly exploited software vulnerabilities and poorly secured access points, especially cloud storage, to steal data and use double extortion (encrypting systems while threatening to publish stolen files). Ransoms were often sought in cryptocurrency. Authorities now control five central servers and the group's domains, while investigators trace proceeds and examine seized devices with support from Europol's European Cybercrime Centre, including cryptocurrency tracing and digital forensics. The FBI said KillSec published samples of stolen patient data from a Puerto Rico breach in March 2025, followed by roughly 180 gigabytes of data after a seven-day countdown expired. UK officers have identified 28 victim companies, and a 25-year-old suspect was arrested in Manchester. Investigators also found that KillSec used artificial intelligence to build and maintain its ransomware infrastructure and identify potential victims.