VULNpocalypse
LowBreach / campaignMonitoring

vortex ransomware group claims attack on El Camino Health, unconfirmed

RansomLook reports the vortex ransomware group lists El Camino Health on its leak site; the claim is unverified, so watch official notices.

Published
Updated
Exploitation
Not confirmed. The only evidence in the sources is a leak-site listing claim tracked by RansomLook.

What happened

According to RansomLook, the vortex ransomware group claims El Camino Health on its leak site. A RansomLook headline dated 2026-11-09 says the listing is for “350+ GB”. A second RansomLook headline dated 2026-11-10 repeats the claim without a size.

This is the group’s own claim, as tracked by RansomLook. A leak-site listing is not proof of an incident. Only the two headlines could be fetched, and the full articles could not be reviewed. The sources reviewed do not say whether El Camino Health has confirmed or denied an incident.

Not confirmed:

  • Whether El Camino Health was attacked at all.
  • What data, if any, was taken, and whether the “350+ GB” figure is accurate.
  • How an attacker would have gained access.
  • Whether any patient or employee information is involved.

Am I affected?

Not confirmed. The headlines name only El Camino Health as the claimed victim. They give no information on affected systems, individuals, software or vulnerabilities, and no CVE is mentioned.

What to do now

  1. Check El Camino Health’s official website and communications for any statement about a cyber incident. None appears in the sources reviewed.
  2. If you are a partner or vendor, ask your El Camino Health contact through your usual channels whether they have guidance.
  3. Treat unexpected emails, calls or texts that cite this claim as unverified, and do not follow links in them.
  4. Check back for updates. This advisory will change if the organization or another source confirms or denies the claim.

Sources