KillSec Ransomware is Attacking Healthcare Institutions in Brazil

KillSec Ransomware has claimed responsibility for a cyberattack on MedicSolution, a healthcare software provider in Brazil, with threats to leak sensitive data unless negotiations begin promptly. According to threat intelligence reporting by Resecurity, the root cause involved data exfiltration from an insecure AWS S3 bucket, and the window of exposure is estimated to be several months.

The attack appears to be the first notable supply chain incident affecting Brazil’s healthcare sector, though KillSec has previously targeted other regions, including government-related data. Stolen healthcare data include medical evaluations, lab results, X-rays, unredacted patient pictures, and records involving minors, with the total volume exceeding 34 GB and more than 94,818 files.

Victims announced as compromised recently include Archer Health (USA), Suiza Lab (Peru), GoTelemedicina (Colombia), and eMedicoERP (Colombia). Brazil’s LGPD regime, enforced by the Autoridade Nacional de Proteção de Dados (ANPD), governs processing of such data, and the ANPD has fined 15 healthcare institutions a total of BRL 12 million for lacking encryption and breach response plans stemming from a 2024 audit.