El Camino Health Data Breach

The Vortex ransomware group has listed El Camino Health, a healthcare organization based in the United States, on its data leak site. SOCRadar’s Dark Web Team identified the listing through dark web monitoring, with the entry published on 2026-11-10. The claim has not been independently confirmed by the victim and is therefore treated as alleged. El Camino Health’s sector and geographic profile align closely with Vortex’s recent targeting behavior, which concentrates on organizations in the United States and Europe and includes a sustained focus on the healthcare industry, making the organization consistent with the type of victim the group has been actively pursuing. Over the previous 60 days, Vortex has claimed approximately 14 victims, with a geographic focus on the United States and Europe. Its most frequently targeted industries during this period are healthcare, manufacturing, and professional services. Recent victims named on the group’s leak site include Scripps and Arthrex, both United States healthcare organizations, alongside Andersen Construction and Solenis, both United States manufacturing companies. El Camino Health fits this pattern precisely, matching the group’s dominant healthcare sector focus and its heavy concentration of United States victims, and overlaps directly with the sector profile of recently claimed victims such as Scripps and Arthrex.

SOCRadar’s infostealer correlation, which checks victim-associated domains against credential logs harvested by information-stealing malware, returned no records for El Camino Health at the time of analysis. No credentials matching the organization were present in the queried dataset when the listing was reviewed. This result should be read as a data gap rather than exoneration: the absence of matching records does not confirm that the organization is unaffected, and the absence of evidence is not evidence that no compromise occurred. Credentials may exist under alternate corporate domains or personal email aliases, may sit in feeds outside the queried dataset, or may simply not yet have been indexed. The credential telemetry matters because infostealer-harvested credentials remain Vortex’s primary initial-access vector. Credential logs produced by stealers such as Lumma, RedLine, and Stealc feed the underground ecosystem from which ransomware operators source validated access to corporate environments, providing a low-cost path into target networks that can ultimately support ransomware deployment. If El Camino Health credentials had been captured by these infostealers, they could potentially be used to reach corporate accounts, remote-access portals, or clinical systems exposed to remote authentication. However, the current telemetry does not confirm that this access path was used against the organization, and the leak-site listing alone does not establish the intrusion method. Given Vortex’s reliance on stealer-derived credentials, El Camino Health should prioritize the defensive measures identified in this analysis: enforcing phishing-resistant multi-factor authentication across all remote access and clinical portals, conducting a credential audit, performing a privileged access review, and reviewing authentication logs for anomalous activity. Continued monitoring of infostealer logs and dark web sources for credentials tied to El Camino Health domains is also advised, as new records could surface as additional datasets are indexed. These steps address the credential-based intrusion paths that Vortex typically employs and reduce the likelihood that exposed credentials can be converted into initial access.