On September 6, 2025, healthcare software provider eMedicoERP appeared on the leak site of the ransomware group killsec. The group claims to have exfiltrated internal files during a ransomware attack, although the exact number of people whose information may be exposed remains unknown.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch eMedicoERP
Get alerted the next time eMedicoERP files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about eMedicoERP’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that eMedicoERP, which provides enterprise resource planning systems to medical practices and related organizations, was listed on killsec’s public leak site. The posting states that internal data was stolen. No sample files have been publicly released in the initial listing, and the precise volume or sensitivity of the stolen information has not been independently verified. The incident follows the group’s typical pattern of encrypting victim systems and then threatening to publish stolen data if ransom demands are not met.
Why This Matters for You and Your Family
When a healthcare vendor like eMedicoERP is breached, the information at risk often includes patient records, billing details, employee information, and internal correspondence that can contain names, addresses, dates of birth, Social Security numbers, and medical treatment data. If you or your family have received care from any clinic or practice that uses eMedicoERP systems, your personal health information and identity details could be among the stolen files. Medical data is especially damaging because it is difficult to change and can be used for insurance fraud, prescription abuse, or long-term identity theft that affects credit, employment, and even family reputation for years.
The Doxxing and Identity-Chain Implications
Stolen internal files frequently contain spreadsheets that link employee or customer names to email addresses, phone numbers, and sometimes family member details. Once attackers or opportunistic criminals obtain even a few of these connections, they can map an entire household across social media, gaming platforms, and data-broker profiles. A credential found in one place can unlock accounts elsewhere, turning a single breach into a chain of takeovers. This is why credential leaks like this one often cascade into account takeovers and doxxing chains, including gaming accounts belonging to you or your children that reuse the same email or password.