Pyramid Healthcare Data Breach

Vortex listed Pyramid Healthcare on its dark web victim site on 2026-11-10. Pyramid Healthcare is a US behavioral health and addiction treatment network, and the listing places the organization within a healthcare-focused cluster of Vortex victims. SOCRadar observed the listing through dark web monitoring of the group’s leak site. The claim joins a campaign that has seen Vortex list approximately 14 victims over the past 60 days, most of them in the US healthcare sector, alongside related victims including Scripps, SimonMed, El Camino Health, ARTHREX, and ALEXION. Pyramid Healthcare therefore fits squarely within the group’s recent targeting pattern, both geographically and by industry. Pyramid Healthcare’s behavioral health specialization adds a sensitive patient data dimension to this healthcare cluster. Addiction treatment and mental health records carry heightened legal and reputational exposure under HIPAA, making organizations in this subsector attractive ransomware targets from a leverage standpoint. The concentration of US healthcare victims in Vortex’s recent activity, including behavioral health operators such as Pyramid Healthcare, suggests the group is actively prioritizing this sector. Healthcare security teams supporting behavioral health operations should treat this listing as a direct signal rather than background noise.

SOCRadar’s stealer-log query for Pyramid Healthcare returned no matching credential records. That result is bounded by the datasets sampled at the time of this report, and credentials may exist in infostealer archives outside that scope. The absence of matching records does not confirm that the organization is unaffected: credentials may reside in feeds not covered by the queried dataset, may exist under alternate corporate domains or personal email aliases, or may simply not yet have been indexed. Credential hygiene reviews and privileged access audits are recommended regardless of the empty query result. Vortex leverages infostealer-sourced credentials as a primary access vector, with logs from stealers such as Lumma, RedLine, and Stealc circulating through dark web markets and Telegram. Credentials harvested in this way can be validated and used to reach corporate accounts, including email, VPN, and remote-access entry points, potentially enabling the initial foothold ransomware operations require. Behavioral health organizations typically run a mix of EHR systems, telehealth platforms, and administrative portals, each carrying its own credential exposure surface. While no direct correlation to Pyramid Healthcare was found in the queried telemetry, this access path remains a plausible scenario the organization cannot rule out. Defenders should maintain continuous dark web and stealer-log monitoring, run proactive credential-hygiene checks, rotate exposed or suspect passwords, and review MFA coverage across all entry points, prioritizing phishing-resistant MFA. Reviewing Microsoft 365, VPN, and remote-access portal activity for anomalous authentication, and monitoring alternate corporate domains for associated credential leaks, rounds out the most direct risk mitigation. SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide that coverage.