On 1 October 2026 DIICOT announced the detention of a 24-year-old Romanian defendant investigated for forming an organised criminal group, illegal access to a computer system, unauthorised transfer of data, illegal operations with computer devices or programs, and blackmail. The detention order was issued on 30 September. The person is presumed innocent; detention is not a conviction.

According to the statement, prosecutors allege that from October 2023 the defendant acted with others in a cross-border group generically called KillSec, aimed at making money from stealing and selling data. Those are investigative allegations, not findings of a court.

The institution describes, in general terms, the identification of systems, the extraction of data and contact with victims under the threat of publication unless a cryptocurrency ransom was paid. This article does not reproduce technical methods, does not identify victims and does not name the defendant.

On Wednesday four search warrants were executed in Bucharest and Vaslui county. Storage devices were seized. Similar actions took place, DIICOT says, in Belgium, Germany, Greece, Spain, the United Kingdom and Finland, with United States authorities also taking part.

The action is part of the international KillSwitch operation, which brought together authorities from several European states and the United States and, according to the statement, concerned about 1,000 attacks. Under Eurojust a joint investigation team was formed in December 2025 between Romania and Belgium, with Greece and Germany joining later. Europol supported information-sharing; two private cybersecurity firms also assisted the inquiry.

During the action, law-enforcement agencies took control of a website associated with the group and said they had secured at least 110 terabytes of data against further unauthorised access. Those are investigators’ reported results, not a verdict.

On Thursday, 1 October, DIICOT referred a request for 30 days of pre-trial detention to the rights-and-liberties judge at Bucharest Tribunal. Until a published ruling, that remains a request, not a court-ordered measure. Losses and roles are for the case file.

Image: Yair-haklai, Palace of Justice, Bucharest, CC BY-SA 4.0, Wikimedia Commons; the Tribunal building, not a photograph of the defendant.

Source consulted: Un hacker din România care face parte din gruparea KillSec, reținut de DIICOT — AGERPRES.