Morton Drug Company Data Breach 2025: 40,051 Affected · Akira Ransomware Claim · Wisconsin LTC Pharmacy

Morton Drug Company, an independent long-term care pharmacy in Wisconsin that operates as Morton LTC and dispenses to assisted-living and skilled-nursing facilities, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on November 10, 2025, reporting 40,051 affected individuals in a Hacking/IT Incident at a Network Server. The intrusion was detected on August 20, 2025, and the Akira ransomware group later claimed responsibility on its dark-web leak portal, asserting it had exfiltrated approximately 22 GB of prescription, patient, insurance, and employee data.

Timeline

• 2025-08-20 — detected: Morton Drug Company identified suspicious activity affecting its IT environment, engaged third-party cybersecurity specialists to investigate and contain the incident, and notified law enforcement.
• 2025-10-21 — other: The forensic investigation concluded, identifying the categories of personal and protected health information involved.
• 2025-11-07 — notified: Morton Drug Company posted its substitute notice of data security incident.
• 2025-11-10 — filed: The breach was filed with HHS OCR as a Hacking/IT Incident at a Network Server affecting 40,051 individuals.
• 2025-11-28 — other: The Akira ransomware group publicly listed Morton LTC on its leak site, claiming to have stolen approximately 22 GB of prescription records, patient information, insurance details, employee records, and business documents.
• 2025-12-04 — other: Consumer-facing reporting expanded; multiple plaintiffs’ firms publicly announced investigations into potential class claims on behalf of affected individuals.

What was exposed

Per Morton Drug Company’s substitute notice and subsequent reporting, the information involved varied by individual and may include pharmacy-record categories:

• Names
• Addresses
• Prescription information (medication names, dosages, fill history)
• Social Security numbers (for a subset of affected individuals)

Akira’s separate leak-site posting additionally claimed exposure of insurance and billing details, employee records, and confidential business documents. Morton Drug Company has not publicly verified those specific claims. Because the affected system was a network server at a long-term care pharmacy, the data set is largely focused on prescription histories and the personal identifiers needed to dispense and bill them.

What the entity is offering

Morton Drug Company’s substitute notice states the company is notifying affected individuals and recommends recipients remain vigilant against identity theft and fraud by reviewing account statements and credit reports. The publicly available notice does not, as of this writing, set out the specific complimentary credit-monitoring or identity-protection terms. Recipients should consult the individual notification letter mailed to the address on file for the duration of any free monitoring offer and the enrollment code.

Class-action posture

No class action has been filed against Morton Drug Company as of this writing. Several plaintiffs’ firms — including Federman & Sherwood, Strauss Borrelli PLLC, Barnow and Associates, and Lynch Carpenter — have publicly announced investigations into potential class claims arising from the incident. ClassAction.org separately notes that its working attorneys have concluded their initial investigation without filing. Pharmacy breaches involving Social Security numbers and prescription histories have historically attracted federal class litigation in the months following notification.

What to do

• Freeze your credit at the three nationwide consumer reporting agencies. With Social Security numbers in scope for some individuals, a freeze is the single highest-leverage protective step.
• Watch for the Morton Drug Company notification letter at the address on file with the pharmacy. The letter lists the specific data elements exposed for you and any complimentary credit-monitoring or identity-protection enrollment instructions.
• Be alert to medical-identity-theft signals. Review explanation-of-benefits statements from your health plan and Medicare summary notices for prescriptions or services you did not receive. Flag pharmacy benefit denials that cite “duplicate fills” you did not request.
• If you are a long-term care resident or family member, ask the facility’s administrator whether your loved one’s pharmacy records were dispensed through Morton Drug Company / Morton LTC and request the substitute notice in writing.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (40,051 affected; filed 2025-11-10; Hacking/IT Incident; Network Server).
• HIPAA Journal — Data Breaches Announced by Morton Drug Company & Physicians to Children & Adolescents — discovery and investigation dates, data elements, affected count.
• ClassAction.org — Morton Drug Company Data Breach Impacts 40K — timeline, December consumer-notice publication, class-action investigation status.
• HIPAA Times — Morton Drug Company Reports Data Breach Affecting 40,000 Individuals — independent corroboration of detection date, investigation, and notification.
• BotCrawl — Morton LTC Data Breach Exposes 22GB of Records — Akira ransomware-group attribution, dark-web leak-portal posting (2025-11-28), 22 GB exfiltration claim.
• teiss — Morton Drug Company Discloses Cybersecurity Breach Impacting 40,000 Patients — independent trade-press reporting on the disclosure.
• Federman & Sherwood — Morton Drug Company Data Breach Investigation — plaintiffs’ firm public investigation announcement.
• Strauss Borrelli PLLC — Morton Drug Company Data Breach Investigation — second plaintiffs’ firm investigation announcement.