Solenis · Breach

[Single source] Vortex claims 1.65 TB Solenis data dump

Nov 09, 2026 · 1 min read

The Vortex data-extortion group has listed Solenis, the Wilmington, Delaware specialty chemicals and water-treatment company, on its leak site as a 'full corporate data dump'. The group claims 1.65 TB across 58,249 files captured in October 2026, 336.8 million CRM records and customer data covering 5,578,872 accounts. Solenis has not confirmed an incident; customers and partners should expect targeted phishing and await an official statement.

By HIFY Radar newsroom Updated 11/09/2026 07:17 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Observed

The latest turn: the Vortex data-extortion group has listed Solenis, the Wilmington, Delaware specialty chemicals and water-treatment company, on its leak site under the label "full corporate data dump," according to threat-intelligence outlet DailyDarkWeb.

Alleged

The numbers come from the gang itself: 1.65 TB across 58,249 files allegedly captured in October 2026, along with 336.8 million CRM records, 20.9 billion rows from a data platform, and customer data tied to 5,578,872 accounts and 1,144,801 contacts.

Observed

None of it is independently verified, and Solenis has not publicly confirmed any incident. For now this is an unverified threat-actor claim, not a confirmed breach.

What happened

Observed

On November 9, 2026, DailyDarkWeb reported that Vortex had added Solenis to its leak site, branding the entry a full corporate data dump.

Alleged

According to the post, the gang says it captured the material in October 2026: 1.65 TB spread over 58,249 files, plus 336.8 million CRM records and 20.9 billion rows from a data platform. The claimed customer slice covers 5,578,872 accounts and 1,144,801 contacts, including names, job titles, email addresses, and direct-dial phone numbers.

Observed

DailyDarkWeb's monitoring also notes that Solenis appeared in the same posting wave as several US health systems and med-tech firms.

Why it matters

Inferred

The claimed contact data is granular: names, titles, emails, and direct-dial phones. That is exactly the raw material for convincing spear-phishing and business email compromise, the scam where attackers impersonate colleagues or suppliers. DailyDarkWeb explicitly warns Solenis customers and partners to expect targeted phishing built from this business-contact data.

Inferred

Solenis sits in specialty chemicals and water treatment, sectors where suppliers touch industrial and municipal operations. If the claim turns out to be real, exposure could reach beyond corporate inboxes into operational relationships, though nothing in the current evidence confirms that.

What to do

Inferred

DailyDarkWeb's bottom line: until the company confirms, treat the listing as an unverified threat-actor claim rather than proof of a breach.

Inferred

For anyone who works with Solenis, the practical move is extra suspicion toward emails and calls that quote real names, real job titles, or familiar direct numbers, since a dataset like the one described is built for exactly that kind of grooming.

Confirmed and still uncertain

Observed

Known so far: the leak-site listing exists as reported by DailyDarkWeb on November 9, 2026, the figures are the gang's own claims, and Solenis has issued no public confirmation.

Inferred

Unknown: whether any of the data is genuine, how it might have been taken, whether a ransom demand preceded the dump, and whether the file counts and row counts describe real systems. None of that appears in the current evidence.

What people are saying

Observed

DailyDarkWeb is the only voice in this batch. Its analyst note stresses that the volume claims are Vortex's own and warns readers not to read the listing as confirmation of a breach.

Observed

Solenis has said nothing publicly, and no other researchers, journalists, or officials appear in the evidence so far.

Evolution

Observed

The picture has not shifted since the November 9 report: a leak-site listing, eye-popping numbers, no verification, and no company response on record.

Inferred

If Solenis confirms an incident, the story moves from claim to breach, with regulatory and customer-notification fallout likely. If the company stays silent, the listing remains an unverified threat that customers still have to hedge against.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The claimed bundle mixes several data types: bulk files (1.65 TB across 58,249 of them), CRM records, meaning the sales-and-support database that logs customer interactions, a much larger set of 20.9 billion rows from an unnamed data platform, and a contact table with names, titles, emails, and direct-dial phones.

Inferred

Direct-dial numbers matter because they enable voice phishing, where a caller who knows your name, title, and colleagues sounds credible fast. Advertising billions of rows also fits extortion logic: scale is the sales pitch.

Sources and evidence

Observed

Everything here traces to one outlet: DailyDarkWeb, which published the finding to subscribers and summarized it publicly on X on November 9, 2026, with a screenshot of the listing.

Inferred

The evidence batch contains no Solenis statement, no independent archive of the leak-site entry, and no third-party verification of the numbers. Confidence in any specific figure should stay low until a second source or the company itself weighs in.