GoTelemedicina targeted by killsec ransomware group

• Ransomware group: killsec
• Country: Colombia
• Sector: Healthcare
• Announcement date: September 6, 2025

Killsec group claims breach of GoTelemedicina

The threat actor known as killsec has announced that it has targeted GoTelemedicina through a post on its leak site. According to the announcement made on September 6, 2025, the group claims to have gained access to the institution's systems and obtained various documents. The group has stated that the data may be made public if a ransom is not paid.

This type of announcement is a common tactic used in double extortion ransomware attacks. In such scenarios, threat actors do not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information. The attackers then use the threat of leaking this data on a public leak site to pressure the victim into paying a ransom. This method increases the leverage of the attacker, as the victim faces not only operational downtime but also significant reputational damage and legal consequences resulting from the exposure of private information.

While the group has listed data on its leak site that it claims belongs to GoTelemedicina, the specific details regarding the total volume of data or the exact ransom demand have not been provided in the announcement.

Data types involved in the alleged leak

The threat actor's claim involves the theft of various documents related to the institution's operations. Based on screenshots provided by the group, the leaked information reportedly includes samples of several sensitive document types. These include:

• Patient records
• Medical forms
• Administrative documents

The exposure of such information poses a significant risk to the privacy of individuals. When medical and administrative documents are leaked, the information can be utilized by malicious actors for identity theft or to launch highly targeted phishing attacks. Such attacks often leverage the stolen personal details to appear legitimate, thereby increasing the likelihood of success against the victims.

Impact and risks for the healthcare sector

This incident carries the risk of exposing sensitive data from an institution operating in the healthcare sector. The nature of the data involved suggests that the breach could violate patient privacy and lead to legal proceedings under Colombian data protection regulations. For healthcare providers, maintaining the confidentiality of patient information is a fundamental requirement, and any breach of this data can have long-lasting consequences for both the patients and the institution.

The motivation behind the attack is also a point of interest. Given the hacktivist origins of the killsec group, it is possible that the motivation behind the attack may be ideological or aimed at reputational damage, in addition to financial gain. This adds a layer of complexity to the incident, as the attackers may be driven by goals that extend beyond simple monetary extortion.

In response to such incidents, organizations are often required to fulfill data breach notification obligations and inform the affected parties. Defensive strategies for organizations in the healthcare sector typically involve implementing robust access controls, continuous monitoring of network traffic, and ensuring that all systems are patched against known vulnerabilities. Furthermore, maintaining comprehensive backups and conducting regular security awareness training can help mitigate the impact of both initial access and subsequent extortion attempts.