El Camino Health · Breach

[Single source] Vortex claims patient data theft at El Camino Health and Scripps

Nov 09, 2026 · 1 min read

Data-extortion group Vortex has listed El Camino Health (California) and Scripps (San Diego) on its new leak site. It claims 350+ GB from El Camino with clinical records, PHI and employee data, and from Scripps patient records plus credentialing and compliance files. No victim has confirmed; El Camino previously disclosed a separate Microsoft 365 account intrusion (Aug 26 to Sep 2, 2026) with no known link to the listing.

By HIFY Radar newsroom Updated 11/09/2026 07:13 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Observed

Dark-web monitoring account DailyDarkWeb reported today that a data-extortion group calling itself Vortex has posted a batch of US healthcare and medical-device victims on its newly launched leak site.

Alleged

The group claims more than 350 GB of data from El Camino Health, including patient clinical records and PHI, alongside listings for Scripps, SimonMed, Karl Storz and Arthrex. None of the victims has confirmed any link, and the reporting explicitly urges readers to treat this as an unverified threat-actor claim rather than confirmation of a breach.

What happened

Observed

Vortex posted the victim listings on its new leak site today. The batch names US health systems and medical-device firms as well as several non-healthcare companies.

Alleged

For El Camino Health (Santa Clara County, CA), the group claims 350+ GB comprising patient clinical records and PHI, physician credentialing files, employee leave and timekeeping data, and emergency contact lists.

Alleged

Other claimed victims include Scripps (San Diego), listed with patient records and PHI, credentialing and compliance files, and executives' personal identifiers; SimonMed imaging centers, with 45+ GB of mailbox exports, scheduling, HR and insurance files; Karl Storz, the German surgical-device maker, with 500 GB of R&D, regulatory and hospital contract files; and Arthrex, the orthopedic device maker, with 700+ GB and more 'tiers' promised. The same wave also lists Solenis, Samtec, Bozzuto, Air Communities and Storage Mart.

Why it matters

Inferred

Patient PHI claims against multiple health systems warrant fast review by those organizations and their vendors, according to the analyst note accompanying the report, because clinical-record exposure carries direct patient-privacy and regulatory consequences if confirmed.

Inferred

The Scripps listing reportedly publishes executives' personal identifiers, which if accurate would raise the risk of targeted phishing, impersonation and fraud against leadership at the named organizations.

What to do

Observed

The reporting recommends that named organizations and their vendors review the claims quickly, while treating the listing as an unverified threat-actor claim and not confirmation of a breach until victims confirm.

Inferred

Vortex is described as a new name with self-reported volumes, so security teams should seek corroboration from victim disclosures, regulatory filings or independent telemetry before acting on the claimed data types and sizes.

Confirmed and still uncertain

Observed

Known: Vortex posted the listings today; El Camino Health separately disclosed a Microsoft 365 account intrusion last month that ran from Aug 26 to Sep 2, 2026.

Observed

Unknown: whether the El Camino listing stems from that Microsoft 365 incident; whether any listed victim is actually compromised; and whether the claimed volumes and data types are accurate, since all figures come from the group itself.

What people are saying

Observed

The only voice in the available reporting is DailyDarkWeb, the dark-web monitoring account that published the alert. Its analyst note states that 'Vortex is a new name and the volumes are its own' and that patient PHI claims warrant fast review by the affected organizations and their vendors.

Observed

None of the named victims is quoted, and no victim organization had confirmed a link to Vortex at the time of the report.

Evolution

Observed

El Camino Health disclosed a separate Microsoft 365 account intrusion last month, with an intrusion window of Aug 26 to Sep 2, 2026; the reporting notes it is unknown whether today's Vortex listing comes from that incident.

Inferred

The leak site is new, and the Arthrex listing promises additional 'tiers' of data, indicating the group may release further batches and that this story is likely to develop.

Reach

Observed

1 independent groups, 1 updates, and 1 engagements.

Technical detail

Alleged

The claimed data types are specific: mailbox exports, scheduling, HR and insurance files at SimonMed; R&D, regulatory and hospital contract files at Karl Storz; physician credentialing, employee leave and timekeeping data, and emergency contact lists at El Camino Health; and credentialing and compliance files plus executives' personal identifiers at Scripps.

Observed

The available reporting does not describe the initial access vector, malware, or any technical indicator for any listed victim; only the leak-site listing and claimed data categories are documented.

Sources and evidence

Observed

This story rests on a single source: a subscriber-only DailyDarkWeb post on X, distributed with its RSS feed entry. No victim statements, regulatory filings, or independent confirmations appear in the evidence batch.

Inferred

Confidence is limited accordingly: every victim name, volume and data category should be treated as an uncorroborated threat-actor assertion until the affected organizations or independent researchers confirm it.