THREAT ACTOR
VORTEX_
ActiveVORTEX is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of VORTEX, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 20
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid.onionVORTEX snapshot · 2026-11-10 23:01
Recent victims
The 50 most recent victims claimed by VORTEX. Total in the index: 20.
| Date listed | Victim | Description |
|---|---|---|
| 2026-11-10 | Karlstorz | 500 GB | Tag: FULL | Published: 2026-09-18 Surgical-device R&D and pro… |
| 2026-11-10 | Andersen Construction | 200+ GB | Tag: FULL | Published: 2026-09-18 ══════════════════════════… |
| 2026-11-10 | SimonMed | 45+ GB | Tag: FULL | Published: 2026-09-23 Imaging-center operations: … |
| 2026-11-10 | El Camino Health | 350+ GB | Tag: FULL | Published: 2026-09-23 Severe healthcare exposure… |
| 2026-11-10 | SOLENIS | 1.65tb | Published: 2026-10-29 SOLENIS — full corporate data dump 1.6… |
| 2026-11-10 | ARTHREX | 700+ GB | Published: 2026-10-30 MORE TIERS WILL RELEASE |
| 2026-11-10 | CRESA | 32.4 GB - 19,261 files | Deadline: 2026-11-12 23:18:56 UTC |
| 2026-11-10 | ALEXION | 2.13 TB - 365,000 files | Deadline: 2026-11-12 23:18:56 UTC |
| 2026-11-10 | PYRAMID HEALTHCARE | 60.5 GB - 16,239 files | Deadline: 2026-11-12 23:18:56 UTC |
| 2026-11-09 | BOZZUTO | |
| 2026-11-09 | SAMTEC | |
| 2026-11-09 | ARTHREX - 700+ GB | MORE TIERS WILL RELEASE |
| 2026-11-09 | SOLENIS - 1.65tb | SOLENIS — full corporate data dump 1.65 TB · 58,249 files · 336,782,3… |
| 2026-11-09 | El Camino Health - 350+ GB | Severe healthcare exposure: tens of thousands of patient clinical reco… |
| 2026-11-09 | SimonMed - 45+ GB | Imaging-center operations: tens of thousands of mailbox exports, patie… |
| 2026-11-09 | Andersen Construction - 200+ GB | ════════════════════════════════════════════════════════════════ ANDE… |
| 2026-11-09 | Karlstorz - 500 GB | Surgical-device R&D and product design files, regulatory and quality d… |
| 2026-11-09 | Air Communities | accounts payable/receivable, audited financials FY2006–FY2013, TRS res… |
| 2026-11-09 | Storage Mart | Massive tenant PII exposure at scale: tens of thousands of rental agre… |
| 2026-11-09 | Scripps | Patient clinical records and PHI, physician credentialing files, workf… |
CONFIRMED ATTACKS
Vortex confirmed attacks: 1 verified incident
Ransomnews has verified 1 Vortex incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in August 2026. United States accounts for 1 of them (100%). The most affected sector is healthcare, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Vortex incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | El Camino Health | Healthcare | United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Vortex's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.