Ransomware group interlock hits Southwest Orthopedic & Reconstructive Specialists
Southwest Orthopedic & Reconstructive Specialists — a healthcare target operating in US has been listed by the interlock ransomware group on 2026-11-10. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Southwest Orthopedic & Reconstructive Specialists |
|---|---|
| Threat Group | interlock |
| Summary | Southwest Orthopedic & Reconstructive Specialists, a healthcare organization in the United States, was listed by the interlock ransomware group on its leak site on 2026-11-10. |
| Date of Breach | 2026-11-10 |
| Discovery Date | 2026-11-10 |
| Region | US |
| Target Domain | southwestortho.com |
| Business Sector | Healthcare |
| Severity | MEDIUM |
Claim by interlock
Southwest Orthopedic & Reconstructive Specialists, a clinic located in Oklahoma, is required by law to maintain protected health information (PHI) as a healthcare facility. However, due to its negligent attitude toward security and unwillingness to resolve the incident, we are disclosing this confidential information, which includes databases containing more than 150,000 SSNs with patient names and addresses, as well as medical records and billing data. This violates the federal HIPAA privacy and security regulations for this clinic, as well as the Oklahoma Security Breach Notification Act.
Posted by the interlock threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
southwestortho.com
Leak post (onion / Tor)
http://southwestorthopedicreconstructivespecialists.ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.