medicheck.io Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 23 September 2024 the ransomware group known as killsec listed medicheck.io on its leak site, claiming it had carried out a ransomware attack and exfiltrated internal files. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the claim has been published. For anyone whose personal or medical information may sit inside those files, the practical stakes are immediate—possible exposure of sensitive health-related records that could be misused for fraud, identity theft or unwanted contact.

Because medicheck.io handles medical-control and absenteeism data for employers and employees in Belgium, even an unverified listing raises concrete questions about what may have left the organisation’s systems and who might now hold it.

Inside the incident

According to the leak-site listing dated 23 September 2024, killsec claims to have conducted a ransomware attack against medicheck.io and to have exfiltrated internal files. No public statement from the company confirming or denying the claim has been reported. The scale of the incident—how many individuals or records may be involved—is undisclosed. The precise method of intrusion, the duration of any unauthorised access, and whether encryption of production systems occurred are likewise unconfirmed. The only concrete detail supplied by the listing is that internal files were taken. Beyond that single claim, public information about the technical course of the incident is limited.

Who is killsec?

Killsec is a ransomware group that has operated publicly since at least 2023. Like many contemporary ransomware actors, it typically employs a double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across multiple sectors, using the same leak-site format to advertise claimed victims and, in some cases, to release sample files. Public reporting describes killsec as opportunistic rather than highly selective, often targeting mid-sized organisations that hold valuable operational or personal data. Its listings are claims made by the group itself; they do not constitute independent verification that an attack succeeded or that the volume of data asserted is accurate. In the present case the group simply lists medicheck.io and asserts that internal files were exfiltrated; no additional statements specific to this victim have been made public.

About medicheck.io

MediCheck is a Belgian service provider that specialises in medical-control and absenteeism-management solutions. Its stated purpose is to streamline medical checks for employers and employees through digital processes intended to make those checks less intrusive and more efficient. Organisations of this type routinely process medical certificates, absence records, identity details of employees, and correspondence between employers, physicians and the service provider. Because the data concern health status and employment, they fall under strict European privacy rules, including the GDPR. A breach affecting such a provider is consequential precisely because the information is both personal and medically sensitive; unauthorised disclosure can affect individuals’ privacy, employment relations and trust in the medical-control system itself.

What data was at risk

The only data type named in the available facts is “internal files” said to have been exfiltrated in the ransomware attack. No inventory of those files, no count of records, and no list of data fields have been published. Organisations that perform medical-control and absenteeism management typically hold employee identifiers, medical certificates or summaries, dates of absence, employer contact details and related administrative documents. Whether any of those categories were present among the files claimed by killsec remains unconfirmed. Public detail is limited to the group’s assertion that internal files left the organisation; the exact contents are therefore unknown.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks are privacy intrusion and secondary misuse. Medical or absence data can be used to craft targeted phishing messages, to attempt identity fraud, or simply to cause personal distress if made public. Employers who rely on medicheck.io may face operational disruption, regulatory scrutiny under data-protection law, and the need to notify affected workers. The organisation itself confronts potential legal obligations to investigate, notify authorities and support those whose data may have been exposed. Because the number of people affected is unknown and the precise data types unconfirmed, the full extent of these risks cannot yet be quantified; the listing alone is sufficient to place both individuals and the company on notice that sensitive material may now be outside their control.

If your data was in this claimed breach

If you have used medicheck.io services or believe your employer has submitted medical-control or absence information through the platform, treat the possibility of exposure seriously even while details remain limited. Monitor financial and medical correspondence for unexpected activity, enable multi-factor authentication on any accounts that share the same email address, and consider placing fraud alerts with credit-reference agencies if identity documents could have been involved. Keep records of any unusual contact that appears to reference your medical or employment history. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional, independent signal of whether personal information linked to the address has circulated publicly.

AICompiled with AI assistance from public sources and published under our editorial standards.