VULNpocalypse
LowBreach / campaignMonitoring

RansomLook reports vortex ransomware group claims CRESA attack

RansomLook reports the vortex ransomware group lists CRESA on its leak site; the claim is unverified, so watch for any official CRESA statement.

Published
Exploitation
Unknown. Only a leak-site claim reported by RansomLook; the headline reviewed does not confirm any attack or exploitation.

What happened

According to RansomLook, a ransomware tracking site, the vortex ransomware group lists CRESA on its leak site. The tracker’s entry is dated 2026-11-10 and is titled “CRESA: claimed by the vortex ransomware group on its leak site” (RansomLook). A leak-site listing is the group’s own claim, not proof of a breach.

Only the headline could be retrieved. The full article could not be reviewed, so this advisory goes no further than what the headline says.

Not confirmed:

  • Whether CRESA has acknowledged an incident. The headline reviewed contains no statement from CRESA.
  • Whether any systems were encrypted or any data was stolen.
  • The volume or type of data involved, if any.
  • How the group would have gained access.
  • Any independent verification of the claim.

Am I affected?

Not confirmed. The only source is a claim tracker’s entry reporting the group’s own listing. It does not say which people, systems or data, if any, are involved. If you have a relationship with CRESA, its official channels are the place to look for any notice.

What to do now

  1. Check CRESA’s official website and communications for any notice about an incident.
  2. Treat unsolicited emails, calls or messages that cite this claim as suspect, and do not open links or attachments in them.
  3. If you share credentials or data with CRESA, follow any guidance it publishes.
  4. Check back for updates. This advisory will change only if a source with more detail or a statement from CRESA appears.

Sources