Scanbo listed on killsec leak site

• Ransomware group: killsec
• Country: United States
• Sector: Technology
• Announcement date: September 22, 2025

Scanbo targeted by killsec group

The technology company Scanbo has been listed on a leak site by the group known as killsec. According to the announcement made on September 22, 2025, the group claims to have targeted the organization, initiating a countdown and threatening to release the company's data.

Ransomware groups often utilize leak sites as a component of double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish this information publicly, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential records.

The killsec group has posted an announcement on their platform that includes information regarding the operations of Scanbo. To support their claims, the group has presented sample documents that are alleged to have been exfiltrated from the company's systems.

Alleged data exfiltration and content

The group has initiated a countdown, signaling an imminent threat regarding the release of the company's information. While the specific volume of data or the exact number of files involved has not been specified in the announcement, the samples provided in screenshots offer a glimpse into the nature of the alleged breach.

The content displayed in the provided screenshots includes highly sensitive personal health information. The data types identified in the samples include:

• Patient names
• Phone numbers
• Addresses
• Medical test results
• Prescription details

The presence of such sensitive information highlights the risks associated with data exfiltration in the healthcare technology sector. When personal identifiers and medical details are compromised, it can lead to significant privacy violations and secondary threats such as identity theft.

Implications for health technology organizations

The nature of the allegedly exfiltrated data, considering Scanbo's operations in health technology, may pose significant risks regarding data protection regulations. The disclosure of such sensitive information could lead to breaches of patient privacy and potentially facilitate secondary attacks, such as identity theft, against the affected individuals.

The killsec group, which possesses a hacktivist background and engages in ransomware activities, suggests that threats to the operational continuity of the company may persist. For organizations operating in the health technology sector, such incidents necessitate a careful evaluation within the framework of data breach notification obligations and potential legal sanctions.

In general, when organizations face such threats, they must consider various defensive and reactive measures. Maintaining robust security postures, implementing strict access controls, and ensuring comprehensive encryption of sensitive data are standard defensive steps. Furthermore, organizations must be prepared to navigate the complex legal landscapes regarding data protection and the necessity of notifying regulatory bodies and affected parties when a breach occurs.

Summary of the incident

The incident involving Scanbo and killsec underscores the ongoing threat posed by ransomware groups that combine disruptive attacks with data extortion. The potential for long-term operational and legal consequences remains a primary concern for companies managing sensitive personal and medical data.