GLOBALMalwareTechnologyInformationRansomwareKillsecRansom DemandedActor NamedMedium

iCare Software

bd_922ae5fa1da1baf4 · schema v1 · pii pii-v1

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Killsec on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: TechnologyDiscovered: 2025-10-23

View aggregator listing on ransomware.live

Source: Ransomware.live

Post text · scraped from the leak site

Founded in 1997, iCare Software, based in the United States, delivers innovative management solutions for childcare and afterschool programs. Serving childcare centers, preschools, afterschool programs, and multi-site operations, iCare automates critical tasks like attendance tracking, staff scheduling, tuition collection, and compliance reporting. Its unique offerings include AI-driven analytics, business intelligence dashboards, and CRM tools to boost enrollment and staff retention. With seamless data migration and robust back-end technology, iCare empowers providers to focus on quality care while streamlining operations and driving growth.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

No regulatory filing corroborates this yet. If an SEC 8-K, state-AG notice, or victim statement lands, DisclosureLens will merge it into an incident and link it here.

Source provenance

Source URL: https://www.ransomware.live/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2025
Raw hash: 113493c49b1bd6d65e89b1ae86903d85d0194a3992a264d030d865f33cfb2efc

Reporting entity

Name: killsec

Victim entity

Name: iCare Software
norm: icare software
Domain: icaresoftware.com
Industry: Technologyllm

What this source establishes

Source ceiling: A leak-site claim can't tell us: discovery date · materiality · notification · affected count · confirmed data types · compliance clock. These stay blank until a regulatory filing or victim disclosure lands.
Attack vector: Ransomware· killsec
Threat actor: KillsecExternalFinancial

Compliance

Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.