The leak site now points at the police

A seizure notice is not a deletion.

SecurityWeek, published the next morning, says that on Wednesday police took over KillSec’s dark-web leak site and blocked further unauthorized access to at least 110 terabytes, presumed to be stolen from victims. CyberScoop dates the arrests to 30 September. Europol’s account, via that reporting, is that a 16-year-old is believed to be the administrator and main operator. Three provisional arrests. Eight homes searched, in Greece, Romania, Spain, and the United Kingdom. Five core servers taken, including machines used to run the operation and to hold victim data. The domains now send visitors to a law-enforcement banner. The group is described as active since about 2024, in through software flaws and weak cloud doors, then copying data out. Authorities say they know of roughly 500 successful attacks. The site, before it was taken, listed roughly 450 victims. Some victims paid. I am not naming the teenager.

What the banner will get briefed as

“They got them” will be read as the files came home. The 110 terabytes are in police hands, which is not the same as back in the victim’s tenant, and not the same as never copied again before the takeover. A victim who paid, or who refused and watched a free download get offered, still has a disclosure question. The initials and dates in an indictment are a prosecutor’s list, not your incident report.

If your name was on that site, keep the copy you made of the listing, with the date. The seizure page does not replace it. Ask counsel whether the seized set includes your files, and do not treat a redirect as proof that a downstream copy died.

The operator being a child does not shrink the archive. It explains why a leak site with hundreds of names could be one person’s desk, until it wasn’t.