Doctor24x7 listed on killsec leak site

• Ransomware group: killsec
• Country: India
• Sector: Healthcare
• Announcement date: October 25, 2024

Killsec claims breach of Doctor24x7

The threat actor known as killsec has listed the India-based telehealth platform Doctor24x7 on its leak site. According to the announcement, the group claims to have successfully compromised the platform's systems. The threat actor alleges that they have gained unauthorized access to the institution's internal systems and have acquired sensitive data belonging to the organization.

In line with common ransomware extortion tactics, the group has initiated a countdown timer. This mechanism is typically used by threat actors to pressure victims by setting a deadline for the publication of stolen data on the internet. Such tactics are a hallmark of double extortion schemes, where attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to damage the victim's reputation or coerce payment.

Details of the alleged data theft

The announcement provided specific details regarding the types of information that the group claims to have exfiltrated from the platform. The leaked data is highly sensitive, as it pertains to both medical records and professional credentials. According to the information shared in the announcement, the compromised data includes:

• Patient names
• Age
• Gender
• Patient registration numbers
• Billing details
• Laboratory results
• Doctor credentials

No information was provided regarding the total size of the data stolen or the specific number of files involved in the breach. Additionally, the group has not disclosed a specific ransom demand in the current listing.

About Doctor24x7

Doctor24x7 is an India-based telehealth platform. The service is designed to enable patients to consult with doctors online and provides access to various healthcare services through its digital infrastructure.

Risk assessment and industry implications

This incident may pose a significant risk due to the potential exposure of sensitive data within the healthcare sector. The leak of patient information could lead to privacy violations and secondary risks such as identity theft. Furthermore, the exposure of doctor credentials could result in reputational damage and facilitate potential supply chain attacks, as compromised professional accounts can be used to access other interconnected systems.

The organization may face legal sanctions under Indian data protection regulations following this alleged exposure. The killsec group, which emerged in 2023, is reported to have hacktivist origins and is known to engage in ransomware activities.

In the broader context of cybersecurity, healthcare organizations are frequent targets for ransomware groups due to the high value of medical records on the dark web. To mitigate such risks, organizations in this sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit. Monitoring for unauthorized access and maintaining strict network segmentation are also critical components of a modern security posture to prevent lateral movement by attackers once they have gained an initial foothold.