VULNpocalypse
LowBreach / campaignMonitoring

Vortex ransomware group claims Solenis leak-site listing

RansomLook reports the vortex group claims Solenis on its leak site (1.65tb); unconfirmed, so await an official Solenis notice.

Published
Updated
Exploitation
Not confirmed. The only evidence is a leak-site listing reported by RansomLook, with no victim confirmation.

What happened

According to RansomLook, a ransomware and extortion tracker, the vortex ransomware group lists SOLENIS on its leak site. The first entry, dated 2026-11-09, says the listing is tagged 1.65tb (RansomLook, 2026-11-09). A second entry, dated 2026-11-10, repeats that the vortex group claimed SOLENIS on its leak site (RansomLook, 2026-11-10).

Only these two headlines could be reviewed. The full articles could not be read, so this advisory goes no further than them.

What is not confirmed:

  • Solenis has not confirmed the claim, according to the material available. No statement from the company was found.
  • There is no independent verification that any data was taken or that systems were encrypted.
  • The meaning of the 1.65tb figure, the entry point, and the type of data involved are not confirmed.
  • No other independent outlet carrying this story was found, only the tracker listings.

A leak-site listing is a claim by the group, not proof of a breach.

Am I affected?

Not confirmed. The sources name Solenis as the listed organisation and say nothing about customers, partners, employees or products. No CVE, software version or vulnerability is mentioned.

What to do now

  1. Treat the listing as an unverified claim and avoid sharing it as established fact.
  2. Watch Solenis’s official channels for any statement or notice about an incident.
  3. If you have a business relationship with Solenis, ask your usual Solenis contact whether any notice applies to you.
  4. Re-check this advisory after Solenis or another primary source comments; it will be updated if details are confirmed.

Sources