Police switched off a ransomware group’s extortion site at the end of September and found 110 terabytes of other people’s files sitting on it. That is the inventory of a single crew, not an industry total.
Europol announced that on September 30th 2026 law enforcement took control of the leak site operated by the KillSec group and secured at least 110 terabytes of data. There were three arrests and eight searches across four European countries. Europol links the group to around 1,000 attacks worldwide, and the person suspected of leading it is a teenager.
The useful question for a business reading this is not whether your name sits somewhere in that pile. It is whether you could find out. Most organizations that have been breached can describe which systems were touched. Far fewer can produce a list of the records that actually left.
What Happened?
KillSec ran what the industry calls double extortion. Encrypt the victim’s systems, copy the data out first, then publish a countdown on a public site and invite the victim to pay before the files go live. The leak site is not a side effect of the attack. It is the leverage.
Europol’s description of the seizure is worth reading closely. The data was secured “against further unauthorized access”. That is a precise phrase, and it is not the same thing as the data having been returned, deleted everywhere, or never taken. Criminal groups keep copies. Affiliates keep copies. A takedown removes the shopfront and, in this case, three people from circulation. It does not “un-steal” anything.
The teenager detail has attracted most of the headlines, and it is genuinely notable, though not in the way it is usually framed. Running an extortion operation at this scale no longer requires deep technical ability. The tooling is rented, the access is often bought, and the hard part has shifted from breaking in to negotiating payment. That cuts both ways: a lower skill floor for attackers also means the defences that stop them are mostly unglamorous and well understood.
Why This Matters for Businesses?
Backups solved the first version of this problem. If your systems are encrypted and you can restore them cleanly by Thursday, the attacker’s main threat is gone. Plenty of organizations spent the last decade getting good at exactly that.
Double extortion changed the question. A restore brings back availability. It does nothing about confidentiality. The files are already on someone else’s server, and your recovery time objective is irrelevant to that fact.
What follows is paperwork, and paperwork has costs. After a confirmed data theft, three different parties will ask you the same question in three different formats. Your insurer wants to know the scope of the loss. Your regulator, whichever one applies to your sector, wants to know who was affected and when you knew. Your customer wants to know whether their data was stolen, and their contract may already tell you how quickly you have to answer.
All three questions reduce to one capability: can you say what was taken, with evidence, and within days rather than months?
Organizations that cannot usually end up choosing between two bad options. Notify everyone, which is expensive and permanently noisy, or notify narrowly and risk discovering later that the scope was larger. Both outcomes are driven by the same gap, and it is not a security gap. It is a data inventory gap.
There’s also the slow tail. Data that surfaces two years after an incident is still your data, and the customer whose details appear in it rarely cares that the original crew was arrested.
What Organizations Should Consider?
None of this calls for a panic. It calls for a short list of questions your IT team can actually answer, and the answers tend to be cheaper than the worry.
Where does our sensitive data live today, not where was it supposed to live? Three years of file shares, departed employees’ cloud storage and the project folder nobody archived are the usual answer. A rough map beats a perfect one that does not exist.
Which accounts can read everything? Service accounts, backup accounts and long-lived admin accounts are the ones attackers want, precisely because they skip the discovery work. Ask how many there are and when each was last reviewed.
If a large volume of data left the network overnight, what would tell us? Not in theory. Which alert fires, who sees it, and what do they do at 2am.
How long do we keep logs? Scoping an incident is mostly log archaeology. If the retention window closes before anyone notices the intrusion, the investigation starts and ends with guesswork.
When did we last restore from backup rather than confirm the job ran? These are different activities, and only one of them proves anything.
Could we produce a defensible list of affected records inside the deadline our contracts already assume? Someone should read those clauses before an incident rather than during one.
The encouraging part: these are the same controls that insurers ask about at renewal. Least privilege, monitored egress, tested recovery and a credible data inventory are not a separate compliance project bolted on to security. They are the answers to the underwriting questionnaire, written down in advance.
What Can You Do?
The gap most mid-market organizations have isn’t detection tooling. It’s the ability to turn an incident into a defensible account of what happened.
Partner with a Cybersecurity & Risk Management firm to cover this ground: identify where sensitive data sits, tighten who can reach it, and make sure the monitoring and logging support an investigation instead of complicating one.
Identity & Access Management address the over-privileged accounts that make mass data theft quick. Internal or External Managed IT Services keep backup and recovery tested rather than assumed, and GRC & Compliance Services connect all of it to the obligations you actually carry, whether those come from a regulator, a customer contract or an insurance policy.
Talk With Our Team
If the question “what would you tell your biggest customer?” does not have a confident answer yet, that is a good conversation to have while nothing is on fire. Get in touch and we will walk through where your data lives, who can reach it, and what evidence you could put in front of an insurer or a regulator after an incident.
If you would rather get a sense of where you stand on your own first, our cyber insurance maturity alignment calculator maps your current controls against what underwriters typically expect.