KillSec: three arrests and 110 terabytes of stolen data

Context

In brief

• Three arrests and eight searches in four countries
• Recovered at least 110 terabytes of stolen data
• Attacks on Swiss companies between October 2023 and June 2025

Key Facts

• Group → KillSec (or KillSecurity)
• Operation → dismantling of an IT structure
• Arrests → three
• Searches → eight
• Countries → Spain, Greece, the United Kingdom and Romania
• Servers seized → five
• Data recovered → at least 110 terabytes
• → attacks against several Swiss companies, between October 2023 and June 2025

On Wednesday, a large international operation made it possible to dismantle the IT structure used by the KillSec ransomware group, also known as KillSecurity. The toll includes three arrests, eight searches in Spain, Greece, the United Kingdom and Romania, the seizure of five servers and the recovery of at least 110 terabytes of stolen data.

The Swiss survey

This was announced by the Federal Office of Police (fedpol) and the Office of the Attorney General of Switzerland (OAG). Since the summer of 2025, the two agencies have been conducting an investigation into a series of attacks against various Swiss companies, which took place between October 2023 and June 2025. The criminal proceedings concern data theft, abusive access to a computer system, data damage and extortion.

How ransomware works

The mechanism described in the source follows a precise sequence. The perpetrators improperly enter the victim's computer system, copy and extract the data of interest, then encrypt the servers. Only then do they demand a ransom in exchange for the decryption key; the request is often made in cryptocurrency.

Double extortion

KillSec practices the so-called double extortion. After the encryption of the servers, if the company refuses to pay, the authors threaten to publish the data on the darknet. The refusal may depend, for example, on a backup made before the theft: the restoration of the data does not eliminate, according to the dynamics described, the threat of dissemination of the information already copied.

Fedpol and the OAG participated in the investigations coordinated by Europol and Eurojust together with seven other countries. The communication released on Thursday underlines the need for cooperation between national and international partners: "Given the international nature of cybercrime, close cooperation between the different partners, both nationally and internationally, is essential," reads a statement released on Thursday.

Operational details

The risk does not end with encryption

For a Swiss company, the sequence described separates two problems. Server encryption is about access to systems; copying and extraction happen first and feed the threat of publication. The backup cited by the source can therefore explain the ransom refusal, but it does not automatically delete the second lever used by the group. It is the difference between recovering one's own systems and preventing the data already stolen from being disseminated.

A balance sheet to be read without overinterpretation

The reference to at least 110 terabytes refers to the material recovered in the operation. The source does not attribute that volume to a single Swiss company, does not indicate the identity of the companies involved and does not report any payments. Sticking to this data avoids turning the balance sheet of the operation into an estimate of the damage for each victim.

The geography should also be read without simplification. The investigation stems from attacks against Swiss companies, while the operation involved four countries and involved the seizure of servers. The participation of fedpol and the OAG, together with Europol, Eurojust and seven other countries, shows a chain of investigation spread beyond Swiss territory alone.

The text does not indicate the sectors involved. The reference therefore remains limited to several Swiss companies; those looking for a distinct picture of the productive fabric can consult the aziende che assumono.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

A reading procedure for companies

To examine the news correctly, those who work in a Swiss company can follow a documentary sequence without adding unconfirmed elements.

Four checks before drawing conclusions

1. Separate dates. The attacks indicated in the investigation date back to the period between October 2023 and June 2025. The Swiss investigation has been conducted since the summer of 2025. The dismantling operation took place on Wednesday, while the communication was released on Thursday.

2. Distinguish the locations. The source links the attacks to different Swiss companies and indicates eight searches in Spain, Greece, the United Kingdom and Romania. The list of countries of the operation should not be transformed into a list of victims' locations.

3. Separate the numbers. Five servers are seized; at least 110 terabytes are the data recovered. The text does not assign the volume to a single company and does not quantify individual damage.

4. Use the terms of the procedure. The case concerns data theft, abusive access to a computer system, data damage and extortion. The ransom is also described as often requested in cryptocurrency, not as a payment already made.

This grid also avoids confusing a threat with an event that has already taken place. The source reports that, in the event of a refusal, KillSec threatens to publish the data on the darknet; it does not report that the data has actually been published. Similarly, the recovery of the servers and data is the communicated result of the operation, not a measure of the damages suffered by each company.

For other indicators of Swiss economic life, the costo della vita in Svizzera is a separate path. For a more in-depth look at personal income, use the calcolatore stipendio.

Source: rsi.ch