Vortex ransomware group claims attack on SimonMed, per RansomLook
RansomLook reports the vortex ransomware group lists SimonMed on its leak site, SimonMed has not confirmed it, so watch for official notices.
- Published
- Updated
- Ecosystem
- Enterprise software
- Exploitation
- No confirmed evidence, only a leak-site listing claimed by the group
What happened
According to the ransomware tracker RansomLook, the vortex ransomware group has listed SimonMed on its leak site. A RansomLook entry dated 2026-11-09 describes the listing as “45+ GB” and says it was claimed by the vortex group (RansomLook). A second RansomLook entry dated 2026-11-10 repeats that the group claims SimonMed on its leak site (RansomLook).
This is a claim made by the group, as relayed by a tracker. SimonMed has not confirmed it in any source we have. Nothing independently verifies the claim. The entry point, the type of data, and whether any data was actually taken are not confirmed. The “45+ GB” figure is the group’s stated size as listed by RansomLook, not a verified amount.
Only the headlines could be retrieved. The full articles could not be reviewed, so this advisory goes no further than them.
Am I affected?
Not confirmed. The sources do not say who or what is affected, which systems were involved, or whether any personal data is included. No CVE, vulnerability, or malware detail is given in the headlines.
What to do now
- Treat the listing as an unverified claim until SimonMed or another primary source confirms or denies it.
- Check SimonMed’s own official channels for any statement or notification. None is cited in our sources.
- Re-check the RansomLook entry for updates (RansomLook). We will update this advisory if a primary source appears.