Scripps Data Breach

The healthcare provider Scripps of the United States was identified in a dark web listing by the threat group Vortex on 2026-11-10. SOCRadar discovered 15 credential records linked to the organization, indicating active exposure across both corporate and patient-facing systems between 2026-10-21 and 2026-11-09. The incident involves 2 internal employee records (Category A) and 13 customer or supplier records (Category B), highlighting a wide exposure surface across the organization’s operational environment. Scripps is part of a larger campaign involving Vortex targeting healthcare entities, joining other listed organizations such as ARTHREX, SimonMed, El Camino Health, ALEXION, and Pyramid Healthcare. This campaign, which has targeted approximately 14 victims over a 60-day period concentrated in the United States, demonstrates that the threat actor is heavily focused on healthcare infrastructure. Scripps’s vulnerability, specifically the presence of Category A credentials immediately preceding the listing date, presents a high-urgency entry in this broader campaign due to the direct risk of unauthorized intrusion.

SOCRadar’s stealer-log correlation returned a severe finding detailing 15 specific credential records associated with the Scripps environment. The exposure window for these credentials spanned from 2026-10-21 through 2026-11-09, correlating closely with the Vortex listing published the following day. The records were divided into 2 internal employee accounts (Category A) and 13 accounts belonging to customers or suppliers (Category B), indicating a potentially deep reach into both internal operations and external relationships. Vortex is known to rely heavily on infostealer-sourced credentials, such as those harvested by Lumma, RedLine, and Stealc, which are circulated through underground markets and Telegram before detection. The presence of these harvested credentials in the Scripps environment suggests that initial access may be facilitated by compromised user accounts. The internal employee credentials pose a heightened risk as they represent direct initial access vectors for an attacker seeking to compromise corporate or clinical systems. To mitigate potential risks, organizations should implement immediate measures based on the findings, including forcing password resets for all 15 exposed credential holders, conducting thorough audits of recent authentication activity on those accounts, and implementing phishing-resistant multi-factor authentication across all remote access, clinical, and patient portal entry points. Furthermore, continuous dark web monitoring for potential future exposures and proactive credential hygiene checks are strongly advised.