ARTHREX Data Breach

Vortex has listed ARTHREX — a US healthcare organization — on its dark web victim site, with the listing dated 2026-11-10. SOCRadar’s Dark Web Team identified the entry while monitoring ransomware leak activity. Notably, ARTHREX is the second US healthcare firm to appear in Vortex’s current wave, alongside Scripps, which suggests the group’s focus on the American healthcare sector at this stage of its campaign is deliberate rather than incidental. A healthcare organization of this profile operates clinical systems and holds sensitive data that make it a valuable extortion target, and the group’s demonstrated willingness to return to the same sector and geographic corridor means the ARTHREX listing fits squarely within Vortex’s established operating pattern. Vortex has claimed approximately 14 victims over the preceding 60 days, concentrating on US-based healthcare and manufacturing while also including European targets in its intake. Recent named victims include Scripps (US, Healthcare), Andersen Construction (US, Manufacturing), Solenis (US, Manufacturing), and Karlstorz (DE, Healthcare). The pattern is consistent: rather than spreading opportunistically across sectors, Vortex returns repeatedly to healthcare and manufacturing in the same geographic corridor. ARTHREX matches this model closely. As a US healthcare organization listed in the same wave as Scripps, it reinforces the picture of a campaign deliberately weighted toward American healthcare, with the group cycling through prominent names in the vertical and maintaining sustained pressure on the sector.

SOCRadar examined its monitored infostealer datasets for credential records tied to ARTHREX and found no matches at the time of this report. This means no credentials associated with the organization appeared in the stealer-log collections SOCRadar currently monitors. The result, however, is a coverage limitation, not a clearance. The absence of data does not confirm that ARTHREX is unaffected: relevant credentials may exist in logs outside the queried datasets, may not yet have been indexed, or may surface later as additional collections are processed. An empty telemetry result should therefore be read as an absence of visibility rather than as evidence that no compromise has occurred. This gap is significant in light of Vortex’s known access methodology. The group’s preferred initial access path runs through infostealer credential logs — including Lumma, RedLine, and Stealc — which are traded on dark web markets and Telegram. Credentials harvested from infected machines and traded this way can serve as ready-made entry points into corporate environments, potentially providing the foothold needed to deploy ransomware. No ARTHREX credentials were observed in SOCRadar’s monitored datasets, so there is no direct correlation at this time between the listing and exposed stealer logs. That distinction matters: it separates an observed telemetry outcome from an attack scenario, and it does not rule out that Vortex obtained or purchased access through other channels or through logs that have not yet surfaced in monitored collections. Recommended actions follow directly from this exposure model. Organizations in this position should implement phishing-resistant MFA on all remote access and clinical system portals, run a credential audit to identify exposed or weak credentials, and review privileged access assignments to contain the impact of any compromised account. Continued monitoring of infostealer datasets and underground channels is also warranted, since today’s absence of matches reflects coverage rather than confirmed safety. More broadly, healthcare organizations in the US medical device and specialty sectors should treat the ARTHREX listing as a direct signal to tighten their own perimeter before they become Vortex’s next entry.