KillSec Ransomware Attacks Healthcare
![KillSec Ransomware Attacks Healthcare]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/45-1-998x499.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/45-1-1996x998.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/45-1-1150x575.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/45-1-2298x1105.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/45-1-740x370.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/45-1-1478x739.png"})
The hacker group KillSec, founded in 2021, has recently made medical institutions a priority target. Since 2025, the KillSec ransomware has been actively attacking the IT systems of the healthcare sector in Latin America and other countries, marking the beginning of one of the most high-profile cyber incidents in recent years.
How it started
The key story is the breach of the Brazilian medical software provider MedicSolution. According to News Interpretation, hackers downloaded gigabytes of data from poorly protected cloud storages through misconfigured AWS S3 buckets. Some of the information remained accessible for months before being discovered.
As a result, tens of gigabytes and nearly 95,000 files were stolen — medical records, test results, X-rays, and even unprocessed patient photographs, including images involving children.
KillSec’s campaign extended beyond a single company: the case also encompasses attacks on medical organizations in other countries — named victims include Doctocliq and Suiza Lab (Peru), GoTelemedicina and eMedicoERP (Colombia), Medical File (Mexico), Ocuco (Ireland), and the U.S.-based Archer Health.
How it happens
According to Cyber Security News, the attackers’ modus operandi looks like this:
- Hackers find vulnerabilities on websites or open cloud buckets and gain access.
- Sometimes the victim is sent a forged document — when opened, a hidden command is executed that loads the encryptor directly into the computer’s RAM (i.e., without visible files on disk).
- Once inside the network, the attackers move laterally across servers using standard remote-access tools to collect and copy medical records.
- The stolen data is published on the Tor network to extort organizations and demand ransom.
![Digital shield under attack – a symbol of the KillSec strike on medical systems.]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/45-2-998x666.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/45-2-1976x1318.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/45-2-1050x700.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/45-2-2100x1400.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/45-2-740x494.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/45-2-1478x986.png"})
Why is this particularly dangerous for healthcare
The loss or leakage of medical data entails serious reputational, financial, and legal consequences. In light of the intensifying cyberattacks, companies in the healthcare sector need to strengthen protection measures and regularly conduct audits of IT infrastructure security.
This applies not only to large clinics — it is often easier for hackers to attack a hundred insufficiently protected small firms than a single major player: less public attention and higher chances of a successful extortion.
![Datami at the Barcelona Cybersecurity Congress 2025: New Horizons in Cybersecurity]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-554x277.jpg","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-1106x553.jpg","tablet":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-380x190.jpg","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-758x379.jpg","mobile":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-560x280.jpg","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/10-1_1-16-9-1118x559.jpg"})
![TOP 5 Largest Cryptocurrency Hacks in History]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/1-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/1-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/1-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/1-1-1118x559.png"})
![Top 10 Cyberattacks That Brought Global Corporations to a Halt]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-6-1-1-1118x559.png"})
![Cloudflare Repelled a Record DDoS Attack of 11.5 Tbit/s]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/44-1-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/44-1-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/44-1-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/44-1-1118x559.png"})
![Dangerous Calendar: A New Tool for Phishing Attacks]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-554x277.jpg","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-1106x553.jpg","tablet":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-380x190.jpg","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-758x379.jpg","mobile":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-560x280.jpg","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/38-1-1-1118x559.jpg"})
![Phishing is Evolving: What Are the Main Threats in 2025 and How to Counter Them]({"desktop":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-554x277.png","desktop2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/discovery\/ds-7-1-3-1118x559.png"})