Polish cops bust alleged teen DDoS kit sellers – youngest just 12
Kids profited from tools used to attack popular websites, say officials
Polish police have referred seven suspected juvenile cybercriminals to family court over an alleged scheme to flog DDoS kits online.
The youths, aged between 12 and 16 at the time of the alleged offenses, all face charges related to selling DDoS tools in what police described as a purely profit-driven scheme.
Poland's Central Bureau for Combating Cybercrime (CBZC) said the tools they sold online were linked to various attacks on organizations.
"Using the tools they administer, popular websites such as auction and sales portals, IT domains, hosting services, and accommodation booking services were attacked," the force said in an announcement (machine translated) on Tuesday.
The investigation began in 2025 after one of the group's leaders, aged just 14 at the time, was identified as a suspected administrator of the tools the group was allegedly selling.
Police visited the teenager at their residence in the Masovian voivodeship, central Poland, collected artifacts, and later analyzed them, leading investigators to the other six suspects.
Last week, CBZC officers visited those six youths across the Masovian, Lublin, Łódź, and Greater Poland voivodeships. During the searches, officers uncovered tools and infrastructure they believe the group used to attack websites, and seized smartphones, laptops, storage drives, a ledger, and handwritten documentation.
The CBZC said the suspects knew each other, stayed in regular contact, and worked together to administer and deploy the tools, knowingly and for financial gain.
The agency added that DDoS attacks are usually short-lived and most users won't notice a 15-minute outage. It cautioned against giving "publicity or glory" to these incidents.
As the suspects were minors, their cases will go to family court rather than the standard criminal courts that typically handle cases involving those aged around 17 and older. Poland's law favors re-education over punishment when alleged crimes concern individuals as young as those involved in this case.
Children under the age of 13 cannot be held criminally responsible, regardless of the offense, while authorities often focus on correction instead of punishment for those aged 13-17, according to Polish law firm Kopeć & Zaborowski.
Individuals as young as 15 can be tried as adults in criminal courts for the most serious offenses, such as murder, but cybercrimes do not fall under this category. ®