Southwest Ortho Ransomware Claim by Interlock (Nov 2026)

Claim Summary

The ransomware group known as interlock has allegedly listed Southwest Orthopedic & Reconstructive Specialists, a healthcare clinic reportedly located in Oklahoma, on its dark web leak site. According to the threat actor, the attack purportedly occurred on or around November 10, 2026.

In its posting, the group claims to have exfiltrated sensitive data and asserts that the clinic was “negligent” toward security and “unwilling to resolve the incident.” The actor further alleges that the disclosed material includes databases containing more than 150,000 Social Security numbers paired with patient names and addresses, along with medical records and billing data. The group also invokes HIPAA and the Oklahoma Security Breach Notification Act in its messaging - a common pressure tactic.

None of these claims have been independently verified. The data volume field in the listing is undisclosed, and no proof samples have been reviewed by Yazoul Security.

Threat Actor Profile

Interlock is a ransomware operation that has been tracked since approximately 2024. Public research on the group remains limited, and its total known victim count is not reliably established. According to reporting, the group has historically targeted a range of sectors, with healthcare and public-facing organizations appearing among its claimed victims.

Notably, no confirmed tooling profile is publicly documented for this actor. The group’s known tools and tactics are, at present, unknown or unconfirmed in open-source research, and no public YARA rules or detection signatures specific to Interlock have been identified for this report. Analysts should treat any tooling attribution as speculative until corroborated by incident responders or malware analysis. Organizations should nonetheless maintain baseline detections for common ransomware precursor behaviors, including unusual lateral movement, mass file encryption, and exfiltration over encrypted channels.

Alleged Data Exposure

The threat actor claims the purportedly stolen material includes:

• Databases allegedly containing more than 150,000 SSNs with associated patient names and addresses
• Medical records
• Billing data

These figures are unverified and should be treated with skepticism. Ransomware groups routinely inflate victim counts and data volumes to increase pressure and extract payment. The specific claim of 150,000+ SSNs is a headline figure that has not been corroborated by the organization, regulators, or independent researchers.

Potential Impact

If the claims are accurate, the exposure of PHI and SSNs would represent a serious regulatory and patient-safety concern under HIPAA and state breach notification law. However, no confirmation of a breach has been issued by Southwest Orthopedic & Reconstructive Specialists, and no regulatory filing has been verified.

Potential consequences, should the claims prove true, could include notification obligations, regulatory scrutiny, identity theft risk for affected patients, and reputational harm. At this stage, these remain hypothetical.

What to Watch For

• Official statement or breach notification from Southwest Orthopedic & Reconstructive Specialists
• Filings with HHS Office for Civil Rights or Oklahoma authorities
• Corroboration of the alleged data volume by independent researchers
• Removal or update of the leak site listing, which may indicate negotiation or resolution
• Any observed use of the allegedly stolen data in fraud or phishing campaigns

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Nothing in this article should be treated as confirmed fact. Yazoul Security has not independently verified the attack, the data exposure, the victim count, or the group’s assertions. The organization has not been confirmed as a victim, and the claims may be exaggerated, inaccurate, or entirely false. Readers should await official confirmation before drawing conclusions.