A previously unseen ransomware operation calling itself Curious Worm has emerged, launching a dark-web leak site and publishing its first batch of alleged victims on 11 November 2026. The initial list names nine organisations, most of them in healthcare in the United States.

The named organisations are SBH Health System in the Bronx, New York; Shannon Medical Center in West Texas; Marquis Companies, a senior living and care provider; Baron & Budd, a plaintiffs law firm; SACHEM Inc, a specialty chemicals manufacturer; Raleigh Orthopaedic; Life Line Screening; Safco Dental Supply; and Atlas Healthcare Partners. The group labels the listings as leaked, but has supplied no file counts, data volumes or sample documents, and none of the named organisations has publicly confirmed an incident.

Claims remain unverified

Threat researchers tracking the listings stress that a name on a leak site is evidence of a claim, not proof of a breach. Ransomware tracker HackerFeeds records Curious Worm as a first-time group in November, with its first victim dated 11 November and nine victims claimed so far in the month. Across all groups, HackerFeeds has recorded 445 ransomware victims claimed on leak sites in November through 11 November, with healthcare the second most targeted sector at 42 victims, behind manufacturing with 51.

The healthcare focus is the most concerning part of the list. Hospitals and care providers hold patient records, medical histories and insurance information that cannot easily be replaced, and disruption to their systems can affect clinical work. A genuine compromise at any of the named organisations could therefore carry privacy, regulatory and operational consequences. At present, however, there is no independently verified evidence that any of them suffered an intrusion, that patient data was stolen, or that ransomware was deployed inside their networks.

What happens next

New ransomware groups often publish recognisable names to build credibility and attract affiliates, so the list may be an attempt to establish visibility rather than a record of nine successful attacks. The listed organisations should still check endpoint telemetry, authentication activity, unusual outbound transfers and backup integrity, and preserve forensic evidence. Threat intelligence teams will be watching for verifiable data samples, changes in victim status, or statements from the named organisations, any of which would help establish whether the claims are genuine.