Apex Spine and Neurosurgery listed on Interlock leak site

• Ransomware group: Interlock
• Country: United States
• Sector: Healthcare
• Announcement date: January 6, 2026

The threat group known as Interlock has published a notice on its leak site, claiming to have acquired data belonging to Apex Spine and Neurosurgery. This announcement, made on January 6, 2026, marks a potential data breach involving a specialized healthcare provider in the United States.

Details of the alleged attack

According to the information provided by the Interlock group, the organization was targeted on January 6, 2026. The group claims to be in possession of approximately 10.6 GB of data allegedly belonging to the medical institution. While the group has posted an announcement on their leak site, they have not provided information regarding a ransom demand.

The group has provided screenshots to support their claim. These images display directory structures that include folders labeled 'OneDrive' and 'Users'. However, the exact nature and the specific content of the leaked data have not been explicitly detailed by the threat actors. The specific file count and the exact contents of the directories remain unknown.

Affected data types

Based on the visual evidence and the claims made by the group, the following types of data are reported to be involved in the incident:

• User data
• OneDrive data

It is important to note that while the directory structures for OneDrive and user files were visible in the screenshots, the full scope and specific contents of the data have not been confirmed.

About Apex Spine and Neurosurgery

Apex Spine and Neurosurgery is a neurosurgery center specializing in the treatment of spinal and cranial disorders. Based in Atlanta, Georgia, the institution provides patient-centered neurosurgical services, including minimally invasive spine surgery.

Risk assessment and industry implications

This alleged data leak may pose a significant risk to the privacy of patient and employee information within the healthcare organization. Because the institution is based in the United States, a potential data breach could trigger legal processes under HIPAA regulations. The exposure of such sensitive information might create opportunities for identity theft or targeted phishing attacks against individuals associated with the institution.

Information regarding the Interlock group remains limited. If the data is eventually verified, it is considered that the organization may face secondary threats through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's systems but also steal sensitive data and threaten to leak it publicly unless a ransom is paid. This adds a layer of pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

In the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations in this sector often face high-stakes risks due to the sensitive nature of medical records. To defend against such threats, institutions typically focus on implementing strict access controls, multi-factor authentication, and comprehensive encryption for data at rest and in transit. Regular monitoring of user activity and cloud storage environments, such as OneDrive, is also a common defensive measure to detect unauthorized access or large-scale data transfers early in the attack lifecycle.