In March 2025, a company in Puerto Rico was given seven days to pay. A countdown appeared on KillSec’s website alongside samples of stolen patient records. When the company did not respond, the group released approximately 180 gigabytes of its data online.
It was one target in an extortion operation linked to roughly 1,000 attempted cyberattacks worldwide, around 500 of which investigators say succeeded. Some victims paid approximately €500,000 in cryptocurrency apiece.
On 30 September 2026, Operation KillSwitch brought arrests and searches across four European countries. Authorities took control of the leak site and secured at least 110 terabytes of stolen data.
The suspected KillSec leader was just 16 years old.
