Member of Ransomware Network That Stole Patient Data From a Puerto Rico Company Arrested

A Dutch national accused of belonging to the KillSec ransomware network was arrested Wednesday, September 30, in the United Kingdom, following an international operation tied to the theft and publication of roughly 180 gigabytes of data from a company in Puerto Rico, including patient information ¹². The case, announced October 1 by the federal prosecutor's office in San Juan, marks the first major legal blow against the group since it extorted the Puerto Rico company in 2025, and gives thousands of islanders a practical reason to check whether their health information was exposed.

What happened

The defendant was identified as Fouad Eltibrizi, 32, known in cybercrime circles as Archduke ². According to the indictment presented to a federal grand jury in Puerto Rico on September 16, 2026, Eltibrizi and his accomplices exploited security vulnerabilities between March and November 2025 to gain unauthorized access to the systems of several companies and organizations, steal confidential information, and store it on servers abroad ². Interim federal prosecutor Hector Ramirez Carbo said at a press conference that "the defendant and his accomplices carried out targeted intrusions against multiple companies and organizations, stole highly confidential information, and attempted to extort their victims for substantial sums of money" ².

In March 2025, KillSec announced it had breached the systems of a company in Puerto Rico and gave it seven days to meet its financial demands, publishing samples of patient information as proof ¹². When the company did not respond, the group leaked roughly 180 gigabytes of stolen data on a dark web portal ¹. The federal indictment also documents similar attacks by the same group against victims in California, Washington, and Louisiana ².

The numbers behind the case

Eltibrizi's arrest was part of international operation KillSwitch, coordinated with U.S. and European authorities to investigate roughly 1,000 suspected cyberattacks attributed to KillSec, of which about 500 have already been identified as successful ². On September 30, authorities carried out eight residential searches in Spain, Greece, the United Kingdom, and Romania, made three additional provisional arrests, and secured at least 110 terabytes of information to prevent further unauthorized access ². The operation involved Europol, Eurojust, and authorities from Germany, Spain, the United Kingdom, Romania, Greece, Belgium, and Switzerland, with assistance from the Netherlands ². FBI San Juan special agent in charge Carlos Goris said "cybercrimes will not go unpunished," calling the arrests an example of the FBI's unwavering commitment to protecting the American public from cybercriminals ². Eltibrizi faces charges of conspiracy to access computer systems without authorization for profit, causing damage to a protected computer, and transmitting extortion threats; if convicted, he faces a maximum sentence of 10 years in prison ². He remains pending extradition from the United Kingdom, and the case is being prosecuted by assistant U.S. attorney Julian Radzinschi ².

What this means for you

If you received a letter or email in 2025 from a medical provider, hospital, laboratory, or insurer in Puerto Rico notifying you of a "data breach" or "security incident," your name, Social Security number, diagnosis, or billing information may be among the data KillSec published on the dark web ¹. Companies do not always name the attacker when they notify victims, so many people have not connected the letter they received months ago to this arrest. The practical risk is identity theft, fraudulent medical bills in your name, and phishing attempts that use your real data to appear credible.

How to check / Checklist

1. Search for your health provider, medical plan, or laboratory's name in the federal Office for Civil Rights (HHS OCR) breach portal at ocrportal.hhs.gov/ocr/breach/breach_report.jsf, filtering for Puerto Rico and a 2025 date ³.
2. Call your provider or insurer directly and ask whether they were notified by the FBI or the federal prosecutor's office as a KillSec victim, and whether they are offering free credit monitoring (standard practice after health breaches, typically for 12 to 24 months).
3. Freeze your credit report for free with all three bureaus, Equifax, Experian, and TransUnion, so no one can open new accounts using your Social Security number.
4. If you suspect your data was exposed, build a personalized recovery plan at identitytheft.gov, the official site of the Federal Trade Commission (FTC) ⁴.
5. Report any extortion attempt, suspicious email, or call referencing your medical history to the FBI's Internet Crime Complaint Center at ic3.gov ³.
6. Change the password on any patient portal where you reuse a password from other sites, and enable two-factor authentication if it is available.
7. Review your medical "explanation of benefits" statements from the last 18 months for services you do not recognize, a sign of possible billing fraud.

What comes next

Eltibrizi is expected to appear before a magistrate at the U.S. District Court for the District of Puerto Rico once his extradition from the United Kingdom is complete ². The charges are accusations, and he is presumed innocent until proven guilty beyond a reasonable doubt. Because operation KillSwitch is investigating roughly 1,000 attacks attributed to the group worldwide, more indictments or additional victim identifications in Puerto Rico are likely in the coming months, possibly including the name of the affected company, which federal prosecutors have not yet publicly disclosed.