The extortion group Curious Worm appeared on leak-site trackers on November 11, 2026 with nine claims filed within a single hour, and six of those targets sit in clinical care rather than the usual manufacturer and law firm mix. Threat monitors logged the first listings together, the pattern of a crew seeding a site with a backlog rather than running one intrusion at a time.
Who the new crew named
Shannon Medical Center, a community-owned health system in San Angelo, Texas, and SBH Health System, a Bronx hospital network, are the largest patient-facing names. Raleigh Orthopaedic, a 27-physician practice in Wake County, North Carolina, and Life Line Screening, which runs preventive vascular screening events, were listed alongside them. Atlas Healthcare Partners, which develops and manages ambulatory surgery centers with nonprofit health systems, and Safco Dental Supply, a dental distributor listed as Saudi-based, complete the clinical set. Marquis Companies, a senior living and home health operator, rounds out nine.
Nothing confirmed yet
Every entry carries the group’s own “Status: Leaked” line, and none of the organizations had publicly confirmed a breach at the time of writing. The tracker record even mislabels Shannon Medical Center with Ireland as its country, a reminder that leak-site metadata comes from the attacker. WatchGuard’s tracker dates the group’s first appearance to October 2026 and describes it as a data broker that has not yet published working infrastructure.
What hospitals should do
Treat a listing as an intelligence lead, not an incident. Check external attack surface and identity logs for the named domain, and rehearse the notification clock: an unconfirmed claim still starts a 60-day HIPAA countdown once you know protected health information was involved. Asking a monitoring vendor whether your domain appears in the listing is faster than waiting for a letter.
