Doctocliq Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who rely on digital tools for medical appointments, clinical records or patient communication may find their personal or professional information at risk when a healthcare-technology platform is listed by a ransomware group. In the case of Doctocliq, public reporting indicates that the company appeared on a killsec leak site in mid-August 2025, with the group claiming that internal files had been taken during a ransomware attack. The number of individuals potentially affected remains unknown, and exact details of what left the organisation’s systems have not been independently confirmed.

For doctors, clinic staff and patients across the countries where Doctocliq operates, the practical concern is straightforward: any exposure of internal files could include sensitive operational or health-related data. Until more information surfaces, those connected to the platform have limited visibility into whether their own records were involved.

What happened

On 19 August 2025, Doctocliq was reported as listed by the killsec ransomware group. According to the available summary, the group claims that internal files were exfiltrated in a ransomware attack. No further public detail has been provided on the precise date the intrusion began, how the attackers gained access, the volume of data taken, or whether any ransom demand was made or paid. The number of people affected is listed as unknown. Public information is limited to the leak-site listing itself and the characterisation of the material as internal files obtained through ransomware activity.

The group behind it: killsec

Killsec is a ransomware operation that has appeared in public reporting as a group that encrypts systems and threatens to publish stolen data on dedicated leak sites if its demands are not met. Like many such actors, it typically claims to have exfiltrated files before encryption and uses those claims to pressure victims. Its listings are public assertions rather than verified disclosures; independent confirmation of the volume, sensitivity or authenticity of any particular data set is often absent at the time of listing. Killsec has been associated with attacks on organisations across multiple sectors, employing standard ransomware tactics of initial access, lateral movement, data theft and extortion. In this instance the group claims Doctocliq as a victim and asserts that internal files were taken; those claims have not been corroborated by independent sources in the material available.

About Doctocliq

Doctocliq describes itself as a platform that helps thousands of doctors in 19 countries manage their practices more efficiently. It connects scheduling, clinical records, finances and patient communication, incorporating artificial intelligence, and positions itself as digital infrastructure for health professionals across Latin America. Organisations of this type typically process appointment data, medical notes, billing information and communications between clinicians and patients. Because the platform sits at the intersection of healthcare operations and personal health information, any compromise of its systems carries elevated consequences compared with breaches at purely commercial or non-medical entities. The company’s own public description emphasises growth and impact in the regional health sector, underscoring why a listing by a ransomware group draws attention.

What data was at risk

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, record counts or data fields has been disclosed. Healthcare-practice platforms of this kind commonly hold clinical notes, patient contact details, appointment histories, financial and billing records, and internal operational documents. Whether any of those categories were among the files claimed by killsec remains unconfirmed. Public detail is limited to the group’s assertion that internal files were taken; the exact contents and the number of individuals whose information may be included are unknown.

The real-world impact

For individuals whose data may have been among the internal files, the concrete risks include potential misuse of personal or medical information for fraud, social engineering or unauthorised disclosure of health-related details. Doctors and clinic staff could face disruption to practice management, exposure of professional communications, or secondary targeting if credentials or internal documents were obtained. For Doctocliq itself, a ransomware incident that includes data exfiltration can lead to operational downtime, regulatory scrutiny under health-data and privacy rules in the jurisdictions where it operates, and erosion of trust among the clinicians and patients who rely on the platform. Because the scale of the claimed exfiltration and the identities of affected parties remain undisclosed, the full extent of these impacts cannot yet be measured. The absence of confirmed numbers does not eliminate the possibility of harm; it simply means that those potentially affected must proceed with caution rather than certainty.

Were you affected?

If you are a doctor, clinic employee or patient who has used Doctocliq, monitor official communications from the company for any notification or guidance. Consider changing passwords associated with the platform and enabling multi-factor authentication where available. Review financial and medical statements for unexpected activity. As a practical first step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Remain alert to phishing attempts that may reference medical appointments or clinic services, and treat unsolicited requests for personal or health information with scepticism until more verified details emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.