Instituto de Ojos listed on killsec ransomware leak site

• Ransomware group: killsec
• Country: Argentina
• Sector: Healthcare
• Announcement date: March 20, 2025

The killsec group claims a breach of Instituto de Ojos

The Argentina-based healthcare organization Instituto de Ojos has been listed on the leak site of the ransomware group known as killsec. According to the announcement made on March 20, 2025, the threat actor claims to have successfully targeted the organization and obtained its data. To increase pressure on the victim, the group has initiated a countdown timer in relation to the alleged breach.

In support of their claims, the threat actors have published several document samples on their platform. These samples are intended to demonstrate the validity of the breach to both the victim and the public. While the group has posted these screenshots, the specific volume of data and the exact number of files involved have not been disclosed by the group.

Data samples and affected information

The information released by the threat actor includes visual evidence of the stolen data. The screenshots provided in the leak site post show various forms that contain sensitive information. Based on the available evidence, the following types of data are reportedly involved in the incident:

• Patient personal information
• Medical records

The exposure of such sensitive health data carries significant implications for the individuals involved. When medical records and personal identifiers are leaked, it creates a heightened risk of identity theft and fraudulent activities targeting the patients of the institution.

Analysis of the threat and potential impact

This incident highlights the evolving tactics used by modern ransomware groups. The group known as killsec is reported to have hacktivist origins but has since transitioned into active ransomware operations. Their current methods suggest that this action may be part of a double-extortion strategy. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to leak it publicly unless a ransom is paid.

For healthcare organizations, the consequences of such breaches extend beyond immediate operational disruptions. The exposure of private medical data can lead to severe legal consequences under Argentina's data protection regulations. Furthermore, the leaked information could potentially be utilized by the attackers in secondary attacks or through highly targeted phishing campaigns against the organization or its clients.

General defensive considerations for the healthcare sector

While the specific details of the organization's response are not available, incidents of this nature underscore the necessity for robust cybersecurity frameworks. Organizations in the healthcare sector often face unique challenges due to the high value of medical records on the dark web. To mitigate these risks, it is common practice for institutions to implement multi-factor authentication, maintain rigorous data encryption standards, and conduct regular security awareness training for staff to prevent phishing.

Ransomware leak sites serve as a public stage for these threat actors to exert maximum psychological pressure. By displaying countdown timers and samples of sensitive documents, they aim to force organizations into compliance. For the healthcare sector, maintaining comprehensive backups and ensuring rapid incident response capabilities are essential steps in defending against the operational and legal risks posed by such sophisticated threat actors.