KillSec Ransomware Hits Brazilian Healthcare Software Provider

KillSec ransomware has hit MedicSolution, a Brazilian healthcare software provider, with researchers saying the attack breached a major element of the healthcare technology supply chain and stole sensitive patient data. The group claimed responsibility on 8 September, and the total stolen data exceeds 34GB across more than 94,000 files, including lab results, X-rays, unredacted patient images and records of minors, according to Resecurity.

The breach was driven by data exfiltration from insecure AWS S3 buckets, with the exposure possibly dating back several months. The incident threatens other Brazilian healthcare organisations that rely on MedicSolution to manage operations, and researchers noted that Doctocliq in Peru and other healthcare institutions in the US, Peru and Colombia have also been targeted recently.

KillSec is described by researchers as a cybercriminal group that evolved from hacktivist origins, and experts emphasise the importance of continuous cloud security monitoring and threat intelligence to detect misconfigured resources and leakage early. According to Resecurity.