Dark Web Intelligence on X: " VORTEX LEAK SITE NAMES US HEALTH SYSTEMS ...

X • November 9, 2026

A data-extortion group calling itself Vortex has posted a batch of US healthcare and medical-device victims on its new leak site today.

• El Camino Health (Santa Clara County, CA): 350+ GB, patient clinical records and PHI, physician credentialing files, employee leave and timekeeping data, emergency lists

• Scripps (San Diego health system): patient records and PHI, credentialing and compliance files; the listing also publishes executives' personal identifiers

• SimonMed (imaging centers): 45+ GB of mailbox exports, scheduling, HR and insurance files

• Karl Storz (German surgical-device maker): 500 GB of R&D, regulatory and hospital contract files

• Arthrex (orthopedic devices): 700+ GB, more "tiers" promised

The same wave also lists Solenis, Samtec, Bozzuto, Air Communities and Storage Mart.

None of the victims has confirmed a link to this group. El Camino Health did disclose a separate Microsoft 365 account intrusion (Aug 26 to Sep 2, 2026) last month; whether this listing comes from that incident is unknown.

Vortex is a new name and the volumes are its own. Patient PHI claims against multiple health systems warrant fast review by those organizations and their vendors. Until victims confirm, treat this as an unverified threat-actor claim, NOT confirmation of a breach.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vortex Leak Site Exposes US Healthcare Data A data-extortion group named Vortex has launched a leak site, revealing sensitive information from several US healthcare organizations, including El Camino Health, Scripps, and SimonMed. The leaked data includes over 350 GB of patient clinical records, personal health information (PHI), and employee data. El Camino Health previously reported unusual activity in its Microsoft 365 accounts, with unauthorized access occurring between August 26 and September 2, 2026. However, it remains unclear if the leaked data is directly linked to this incident. Other affected organizations include Karl Storz and Arthrex, with claims of extensive data volumes. None of the victims have confirmed a breach connection to Vortex as of now. Organizations are advised to treat this as an unverified threat until further confirmation is provided. 3 sources 51

Extracted Entities

Dark Web Intelligence on X: " VORTEX LEAK SITE NAMES US HEALTH SYSTEMS ...

The full story

Extracted Entities

Attack Types (1)

Companies (10)

Industries (1)

Platforms (1)