KillSec Exploits Zero-Day to Breach Ocuco: 241K Patients Exposed

Daily Security Review

In this episode, we break down one of 2025’s most significant healthcare cybersecurity incidents: the ransomware attack on Ocuco, a global eyecare software provider. On April 1st, 2025, threat actors from the KillSec ransomware group exploited CVE-2024-41197 — a critical authentication bypass in Ocuco’s INVCLIENT.EXE — to gain Administrator-level access and exfiltrate over 340GB of sensitive data, including patient names, SSNs, driver’s license numbers, and financial records.

KillSec, a group known for combining ransomware with ideological messaging, claimed responsibility via their dark web leak site. Despite positioning themselves as hacktivists, their modus operandi follows a double extortion model, typical of financially motivated groups. Their tactics reflect a larger 2024–2025 trend: politically charged language masking ransom demands.

We dive into the technical details of CVE-2024-41197, a zero-day (or possibly N-day) vulnerability with a CVSS score of 9.8 that allowed unauthenticated remote code execution. Ocuco learned of the breach the same day KillSec publicized it, and the company later reported the incident to the U.S. HHS and Ireland’s DPC under GDPR obligations.

This episode also connects the dots across broader healthcare cybersecurity trends. With 458 ransomware attacks tracked in healthcare in 2024, and groups like LockBit 3.0, RansomHub, and BianLian still active, this incident reflects the sector's growing exposure to zero-day exploits, supply chain flaws, and AI-augmented social engineering.

We end with a focused discussion on prevention: how organizations can strengthen software supply chain defenses, implement DevSecOps practices, and prepare breach response plans that comply with GDPR and HIPAA alike.