Back to all incidents

Morton LTC Pharmacy

mortonltcpharmacy.com
EMERGING

Morton LTC Pharmacy was listed on the RunSomeWares ransomware extortion leak portal. Morton LTC is an independent fourth-generation family-owned Wisconsin pharmacy.

Observable Status EMERGING
Industry / Sector Healthcare
Incident Classification Network Intrusion & Data Exfiltration
Attributed Threat Actor RunSomeWares
Affected Population Scope Under Audit
First Seen 2026-10-08
Last Updated 2026-10-08
Authentication Credentials
OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

10% CONFIDENCE
1. Primary Authority UNVERIFIED CLAIM Base weight: 6%
2. Evidence Specificity +7% Domain & Scope Telemetry
3. Corroboration Curve +0% 1 independent domain
4. Timeline & Staleness -3% 1 milestone logged
Corroborated Source Domains:
ransomware.live

Technical Forensic Briefing

Incident Overview

Morton LTC Pharmacy, operating within the Healthcare sector, has been subject to a cybersecurity incident initially observed on 2026-10-08. Ground-truth telemetry indicates the threat activity is attributed to threat actor RunSomeWares.

Morton LTC Pharmacy was listed on the RunSomeWares ransomware extortion leak portal. Morton LTC is an independent fourth-generation family-owned Wisconsin pharmacy.

Compromised Assets & Data Scope

The specific volume of affected customer or organizational records remains under active forensic investigation. Primary affected online infrastructure and perimeter domains include mortonltcpharmacy.com.

Specific classes of compromised records, credentials, or proprietary information continue to be audited through ongoing forensic investigation.

Authoritative Directives & Vendor Disclosures

  • Continuous Telemetry Monitoring: Formal statutory regulatory filings (SEC Form 8-K, State AG portals) and sovereign agency advisories (CISA, NCSC) are continuously monitored via automated ingestion pipeline.

Milestone Timeline (1 events logged)

2026-10-08 11:54 UTC
UNVERIFIED CLAIM

Morton LTC Pharmacy Listed on RunSomeWares Ransomware Extortion Portal

Have updated information or a new verifiable source?

This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.

Propose Update via GitHub