Skip to content
Vortex Leak Site Exposes US Healthcare Data

Vortex Leak Site Exposes US Healthcare Data

First seen 9 Nov 2026, 23:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 23:40 UTC
  • •Vortex claims to have leaked sensitive data from multiple US healthcare systems.
  • •El Camino Health reported unauthorized access to Microsoft 365 accounts prior to the leak.
  • •No victims have confirmed a breach connection to the Vortex group yet.

A data-extortion group named Vortex has launched a leak site, revealing sensitive information from several US healthcare organizations, including El Camino Health, Scripps, and SimonMed. The leaked data includes over 350 GB of patient clinical records, personal health information (PHI), and employee data. El Camino Health previously reported unusual activity in its Microsoft 365 accounts, with unauthorized access occurring between August 26 and September 2, 2026. However, it remains unclear if the leaked data is directly linked to this incident. Other affected organizations include Karl Storz and Arthrex, with claims of extensive data volumes. None of the victims have confirmed a breach connection to Vortex as of now. Organizations are advised to treat this as an unverified threat until further confirmation is provided.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 8h ago How this analysis works

Timeline

2026-09-01
El Camino Health detects unusual activity
El Camino Health identified unauthorized access to four Microsoft 365 accounts, leading to an investigation.
Openclassactions
2026-11-09
Vortex leak site launched
Vortex published a list of US healthcare and medical-device victims on its new leak site, including extensive data claims.
X

More articles in this cluster (3)

Following this threat?

Track Air Communities in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 3

Common questions

What data was leaked?
The leaked data includes patient clinical records, PHI, and employee information from multiple healthcare organizations.
How did the breach occur?
El Camino Health reported unauthorized access to Microsoft 365 accounts, but it is unclear if this is linked to the Vortex leak.
What should affected organizations do?
Organizations should review their security measures and monitor for any unauthorized access or data breaches.