Doctocliq listed on Killsec ransomware leak site

• Ransomware group: Killsec
• Country: Mexico
• Sector: Healthcare
• Announcement date: August 19, 2025

The ransomware group known as Killsec has listed the healthcare technology platform Doctocliq on its dedicated leak site. The threat actor claims to have successfully conducted an operation against the organization's digital infrastructure, asserting possession of the company's data.

The alleged attack and group claims

According to the announcement made on August 19, 2025, Killsec has officially listed Doctocliq on its leak site. The group claims to have targeted the institution's digital infrastructure to facilitate their extortion attempt. The listing is characterized by the presence of a countdown timer, a common tactic used by ransomware groups to pressure an organization into responding to their demands within a specific timeframe.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure through a method often referred to as double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release. By utilizing a countdown timer, groups like Killsec create a sense of urgency, aiming to force the victim into compliance to prevent the dissemination of stolen data.

Data types involved in the leak

The threat actor has provided evidence to support their claims through screenshots. These images appear to display various documents that resemble highly sensitive information. The materials shown in the leak include:

• Patient medical records
• Clinical appointment data
• Financial data

The presence of such documentation suggests that the breach may involve critical information used in daily medical operations and administrative management. While the specific volume of data or the exact number of files involved has not been disclosed by the group, the nature of the displayed documents points toward a significant breach of privacy.

About Doctocliq

Doctocliq is an AI-powered healthcare management platform designed to assist doctors in managing their clinics with increased efficiency and profitability. The platform provides essential digital infrastructure for healthcare professionals operating within Latin America. Its services integrate several critical functions, including appointment scheduling, the maintenance of electronic health records, financial management, and various tools for patient communication.

Risk assessment and industry implications

The alleged leak poses a high risk due to the sensitive nature of the data contained within a healthcare technology platform. Because the platform manages the intersection of medical and personal information, the exposure of such data can lead to severe consequences for the individuals involved. Specifically, the compromise of patient data may facilitate identity theft or enable highly targeted phishing attacks against patients and healthcare providers.

Furthermore, the organization may face significant legal challenges. Given the location of the organization, it is likely that the institution could face legal sanctions under Mexican data protection regulations following such a breach. The potential for regulatory scrutiny increases when sensitive medical and financial records are compromised.

The profile of the Killsec group is also a factor in assessing the risk. Known for their hacktivist origins and their subsequent transition into a ransomware-as-a-service model, there is an increased likelihood that the stolen data could be sold to third parties on the dark web. This transition from hacktivism to a service-based model often means that the primary motivation is financial gain through the sale of data or the fulfillment of ransom demands.

For organizations operating in the healthcare technology sector, this incident highlights the necessity of robust security measures. To mitigate such risks, companies often need to conduct comprehensive reviews regarding their supply chain security and patient privacy protocols. Strengthening digital defenses, implementing strict access controls, and ensuring continuous monitoring of the digital infrastructure are standard defensive steps used to protect against the evolving tactics of ransomware groups.