Fouad Eltibrizi, a Dutch citizen known online as Archduke, was arrested in the United Kingdom last Wednesday as part of Operation KillSwitch, an international crackdown on the cybercriminal group KillSec, federal authorities announced late last week. He is accused of helping run a ransomware group that stole and leaked large amounts of sensitive data from a Puerto Rico company.
According to the U.S. Attorney’s Office in Puerto Rico, a federal grand jury indicted Eltibrizi on Sept. 16 on charges including conspiracy to access protected computer systems for profit, causing damage to a protected computer, and transmitting extortion threats to obtain information. Interim U.S. Attorney Héctor Ramírez Carbó said Eltibrizi and his co-conspirators carried out intrusions against multiple companies and organizations, stole highly confidential information, and tried to extort their victims for substantial sums of money.
Prosecutors say that between March and November 2025, KillSec exploited security vulnerabilities to infiltrate victims’ networks and siphon data to overseas servers, then posted samples of stolen files on a dark-web portal and demanded payment to prevent full disclosure. Prosecutors say the group carried out hundreds of intrusions against companies and institutions in the United States and Europe.
In March 2025, KillSec claimed responsibility for breaching a Puerto Rico company and gave it seven days to meet its demands. When the company did not respond, the group released roughly 180 gigabytes of data, including patient information. The indictment also cites similar attacks against victims in California, Washington and Louisiana.