A newly registered extortion group is trying to force two US life sciences companies into a two-day deadline, publishing Alexion and Pyramid Healthcare on its leak site with a Thursday cut-off and a 2.13 TB exfiltration claim on the drugmaker.
Vortex only appeared in public tracking this week. Ransomware.live flags it as an emerging operation, a caution that applies to the whole listing rather than to the victims.
Targeting the biotech supply chain
Alexion, AstraZeneca’s rare disease unit, develops therapies for complement-mediated disorders and runs manufacturing and patient support programs across several states. Pyramid Healthcare operates behavioral health and addiction treatment programs in Pennsylvania.
That pairing is the pattern worth watching. A gang with no track record has chosen one biopharma manufacturer and one behavioral health provider, two sectors where downtime during a negotiation carries immediate clinical consequences.
What the claim actually says
Public details are thin. The listing carries a data volume, a deadline of November 12, and a screenshot. It gives no description of stolen record categories and no sample file index, so claims about patient or trial data should be treated as unverified until the companies respond.
Neither Alexion nor Pyramid Healthcare has publicly confirmed an intrusion. Under HIPAA, a covered entity that has not yet determined which individuals are affected is not automatically exempt from starting its four-factor risk assessment, and work done during a pending extortion negotiation counts.
Defensive moves for pharma and clinical ops
Emerging groups typically buy access rather than build it. Audit identity provider logs for unfamiliar service accounts, review third-party remote access to manufacturing and quality systems, and pre-agree who calls regulators if a deadline passes. For clinical trial sponsors, confirm that patient data sits outside the estate attackers can reach.
