A ransomware attack by the hacker group KillSec disrupted MedicSolution, a critical software provider for Brazil’s healthcare sector. The attackers exfiltrated over 34 GB of sensitive data (94,818 files), including medical evaluations, lab results, X-rays, unredacted patient photos (including minors), and records from multiple institutions such as Vita Exame, Clinica Especo Vida, and Laboratório Alvaro. The breach stemmed from misconfigured AWS cloud buckets, exposing data without complex hacking. KillSec threatened to leak the stolen data unless ransom negotiations began, risking extortion, reputational damage, and operational disruptions across dependent healthcare providers. The incident underscores persistent vulnerabilities in cloud security and incident response within the sector, with MedicSolution failing to issue a public statement despite regulatory obligations under Brazil’s LGPD (Lei Geral de Proteção de Dados), which mandates breach reporting within three business days. The attack is part of KillSec’s broader campaign targeting Latin American healthcare, with prior victims including Archer Health (US), Suiza Lab (Peru), and Doctocliq (Peru), amplifying concerns over systemic cybersecurity gaps in regional healthcare infrastructure.