Hacking group Killsec claims data breach at MediCheck, over 50,000 documents stolen

Ransomware operation Killsec says it’s responsible for the data breach at MediCheck, a Belgian service provider specialized in medical control and absenteeism management solutions.

On its extortion site on the dark web, Killsec claims to have exfiltrated “sensitive data related to personal identity and medical conditions, including patient names, locations, accident details, certifications of incapacity for work, and specific medical conditions”.

To prove they are in possession of the data, Killsec has uploaded three documents. A ransom deadline has been set to 1 October.

According to cyber threat intelligence and malware analyst shadow hunter, the threat actor has stolen approximately 600 GB of sensitive data.

Belgium news outlet Het Laatste Nieuws has confirmed that hackers were able to steal 50,000 documents from more than 750 medical examiners containing sensitive information, dating back to January 2023.

“We are still investigating what exactly happened. We were informed on Monday evening. We decided to immediately shut down our systems. We have completed doctor’s appointments, but aren’t planning any new ones for the time being,” says Dina De Haeck, CEO of MediCheck.

She assures victims the company takes this data breach seriously. MediCheck has called upon the help of a Dutch cybersecurity firm and has notified the police and data protection authority (DPA) of the incident.

So far there hasn’t been any contact with Killsec.

Whether MediCheck is prepared to pay ransom in order to prevent the data from spreading, hasn’t been decided yet. “At the moment we are keeping all options open,” De Haeck states. Patients whose information has been leaked, have been notified.

Killsec, also known as Kill Security, is a group of activist hackers that has been active since 2021. They have targeted various industries and countries, including government, manufacturing, defense, financial services, sports, and gaming.

Earlier this month, Killsec stole confidential information from several Belgian insurance companies by hacking Penbox, a company from Brussels that works with over 400 clients in the insurance industry. Killsec wouldn’t say what data they stole, but from leaked documents we know they are in possession of at least full names, addresses and login details.