KillSec dismantled: 110 TB of data seized

Context

In brief

• September 30, 2026: Dismantled the network used by KillSec
• Three arrests and eight searches in four countries
• Recovered at least 110 terabytes of stolen data
• OAG and fedpol involved as operational and strategic partners

Key Facts

• Published → 1 October 2026
• Criminal proceedings → from 31 July 2025
• Transaction → 30 September 2026
• International coordination → Europol and Eurojust with 7 other countries
• Arrests → three individuals
• Searches → eight, in Spain, Greece, the United Kingdom and Romania
• Data recovered → at least 110 terabytes
• Servers seized → five

On 30 September 2026, a large-scale international operation led to the dismantling of an IT structure used by the ransomware group "KillSec". The Federal Office of Police fedpol and the Office of the Attorney General of Switzerland (OAG) were directly involved as operational and strategic partners. The communiqué was published on 1 October 2026.

The intervention led to the arrest of three individuals and the seizure of evidence and assets. Eight searches were carried out in Spain, Greece, the United Kingdom and Romania. The authorities recovered at least 110 terabytes of stolen data and seized five servers that the group used to store its victims' data. The seizure therefore concerned both the storage infrastructure and other evidence.

The Swiss file

Since 31 July 2025, the OAG has been conducting criminal proceedings against unknown persons for data theft, abusive access to a computer system, data damage and extortion. The press release also includes references to Articles 143, 143bis, 144bis and 156 of the SCC. The file was created after a series of ransomware attacks against various Swiss companies, attributed to KillSec, or "KillSecurity", between October 2023 and June 2025.

The investigations were conducted internationally and coordinated by Europol and Eurojust together with 7 other countries. fedpol and the OAG participated in the activities, while the dismantling operation took place on 30 September 2026.

The double extortion method

The source also reconstructs how ransomware works. The perpetrators improperly access the victim's system, copy and extract the data of interest, then encrypt the servers and demand a ransom in exchange for the decryption key. Payment is often demanded in cryptocurrency.

KillSec practices so-called "double extortion": after the encryption of the servers, if the company refuses to pay, the perpetrators threaten to publish the data on the darknet. The source cites the existence of a backup made before the data was stolen as a possible reason for the refusal.

Operational details

What it means for those who do business in Switzerland

For those who live or work in Switzerland, the most concrete operational point is the audience of possible targets. The OFCS specifies that anyone can be one: a public body, a company or a private individual. Not only companies of strategic importance, therefore. The report is not presented as a step reserved for large groups, but as a tool to strengthen investigations and the fight against cybercrime.

Two risks in the same attack

The dynamics described in the press release combine operational blocking and data exposure. The encryption of the servers creates the ransom demand to obtain the key; the copying and extraction of the data, on the other hand, opens up the threat of publication on the darknet. Even those who can refuse payment, for example because they have a backup prior to the theft, are therefore exposed to the second pressure. The text describes this mechanism and the investigative response of the authorities.

The reference to cryptocurrency also delimits the nature of the request: the ransom is linked to the decryption key. The issue remains distinct from the information on conti bancari in Svizzera: here the point is the theft, encryption and possible disclosure of data.

Before and after the seizure

Before the operation, the IT structure allowed the group to store victims' data on its servers. After the seizure, the authorities explain that disrupting the operation of the network and stealing servers and data limits the ability of the perpetrators to continue criminal activities. The seized material also serves to collect new evidence, to support the identification of cybercriminals and to better understand the role and degree of involvement of the different actors.

However, the coup does not close the proceedings. The investigations by the OAG and fedpol are continuing. The presumption of innocence applies to all participants and the OAG does not provide any further information on the ongoing investigation. For the productive fabric, the only verifiable conclusion is therefore twofold: cooperation can disrupt an infrastructure, but the criminal investigation continues according to the ongoing proceedings.

A response that passes through the cantons

The preparatory work was carried out by fedpol under the direction of the OAG, in collaboration with the cantonal police and the OFCS. The investigators collected and analysed detailed information on the network's modus operandi and coordinated exchanges with foreign partners. The resources on aziende che assumono relate to the labour market; this case, on the other hand, shows how a digital threat can involve companies and authorities on several levels.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

What to do after an attack

The OFCS warning indicates a clear course of action for those who suffer a cyber attack in Switzerland: report the facts to the competent authorities or file a complaint directly with the police or the OAG. The path applies to a public body, a company and a private individual, because the source considers each person to be a potential target.

Four steps indicated by the source

1. Recognize the case. The ransomware described involves undue access to the system, copying and extracting data, encrypting servers and demanding a ransom, often in cryptocurrency. The so-called double extortion adds the threat of publishing data on the darknet when the victim does not pay.

2. Select the channel. The report can be addressed to the competent authorities. Alternatively, the report can be submitted directly to the police or the Office of the Attorney General of Switzerland. The OFCS calls out both possibilities and links the report to strengthening the investigation.

3. Activate cooperation. The facts reported contribute to the investigative work carried out by fedpol under the direction of the OAG, together with the cantonal police and the OFCS. The information collected can feed into exchanges with foreign partners, a component already used in the investigations into the group.

4. Consider judicial follow-up. The authorities continue to identify the perpetrators, arrest them and, when they are abroad and circumstances permit, request extradition to Switzerland. The stated objective is also to obtain a criminal conviction.

After reporting

The recall of the OFCS is not limited to companies of strategic importance. It includes public bodies, companies and individuals, i.e. all those who the source considers potential targets. The report serves to strengthen investigations and, more generally, to combat cybercrime.

The statement states that the presumption of innocence applies to all participants and that the OAG will not provide any further information on the ongoing criminal investigation for the time being. However, the activities of the OAG and fedpol continue. For those operating in Switzerland, the choice indicated by the OFCS remains concrete: report the attack to the competent authorities or file a complaint with the police or the OAG.

To orient yourself on the personal economic picture after consulting these indications, use the calcolatore stipendio/imposte.

Source: admin.ch