Loading story…
KillSec ransomware has targeted healthcare IT vendors in Brazil, Colombia, and Peru, with the most significant breach affecting Brazilian provider MedicSolution. Over 34 GB of sensitive patient data, including medical records and images, were exfiltrated due to an insecure AWS S3 bucket, and the group is threatening to leak the data unless negotiations occur. The attacks highlight KillSec's use of supply chain compromise, ransomware-as-a-service, and extortion tactics, with healthcare organizations urged to strengthen defenses and comply with data protection regulations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The KillSec ransomware group breached MedicSolution, a major Brazilian healthcare software provider, exfiltrating over 34GB of sensitive patient data. The attack exploited insecure AWS S3 buckets and threatens to impact numerous healthcare organizations relying on MedicSolution's cloud services. The group has also targeted healthcare institutions in the US, Peru, and Colombia, highlighting the growing risk of supply chain attacks in the sector.
Jun 29, 2026
Confirmed ransomware activity has remained persistently high worldwide, with a Ransomnews dataset logging **9,291 verified attacks** since 2018 and roughly **1,400 to 1,550 incidents annually** since 2023. **LockBit** remains the leading group by confirmed victims since 2019, while **Qilin** leads 2026 year-to-date with 53 confirmed victims, followed closely by **The Gentlemen** with 51. The **United States** accounts for about half of confirmed attacks in the dataset, and healthcare remains one of the most heavily affected sectors, with **1,297 confirmed healthcare incidents** recorded across the full period. Attacks on healthcare accelerated further in the first half of 2026, with overall incidents rising **14%** and attacks on healthcare businesses and service providers jumping **35%** from the second half of 2025 and **110%** from a year earlier. Reporting attributes the shift to criminals targeting central vendors and service providers to reach multiple downstream hospitals and steal large volumes of sensitive data; recent examples include incidents involving **University of Mississippi Medical Center**, **Unimed**, **TriZetto Provider Solutions**, and **QualDerm Partners**. Security leaders say hospitals and clinics still face chronic exposure from legacy medical devices, patching constraints, third-party dependence, limited budgets and staffing, and social-engineering attacks, raising the risk of operational disruption and patient-care delays.
Jul 10, 2026
Medibank said attackers accessed personal data belonging to all of its customers and some authorized representatives, affecting about **9.7 million** current and former customers. The Australian health insurer said the compromised information included identifying details and health claims data for roughly **480,000** customers, and warned that all accessed data may have been stolen. Medibank later said it would **not pay the ransom**, citing expert advice that payment would not ensure the return of data or prevent its publication, while Australian officials backed the decision and warned that ransom payments fuel further extortion. In Romania, hospitals were forced offline after a ransomware attack hit a healthcare IT platform used by multiple medical facilities, disrupting operations across the country. Reporting indicated the crisis was linked to a **third-party incident**, underscoring how attacks on shared service providers can cascade across healthcare organizations. Together, the incidents highlight how cybercriminals are targeting healthcare entities through both direct intrusions and attacks on critical external platforms, exposing sensitive patient data and interrupting care delivery.
Jun 29, 2026