Morton LTC Pharmacy listed on RunSomeWares leak site

• Ransomware group: RunSomeWares
• Country: United States
• Sector: Healthcare
• Announcement date: October 8, 2026

RunSomeWares claims a data breach at Morton LTC Pharmacy

The threat group known as RunSomeWares has listed Morton LTC Pharmacy on its leak site, alleging a data breach. This announcement, made on October 8, 2026, suggests that the organization has been targeted in a cyberattack. While the group has published the organization's name on its platform, specific details regarding the nature of the breach remain limited.

Details of the alleged attack

According to the claims made by the RunSomeWares group, they successfully gained access to the systems of Morton LTC Pharmacy. The group asserts that they have obtained various files through this unauthorized access. Information regarding the specific capabilities or the identity of the RunSomeWares group is currently limited, as the group maintains a relatively low profile in the threat intelligence landscape.

The group's announcement appeared on their dedicated leak site on October 8, 2026, which coincides with the date they claim the attack occurred. This type of public listing is a common tactic used by ransomware actors to pressure victims into meeting demands.

Data involved in the claim

Regarding the content of the alleged breach, no specific details have been provided by the threat actor. The leak site currently only contains links to download files, but the specific nature or types of the data contained within those files have not been disclosed. The listing does not name any specific data types or categories of information that have been compromised.

About Morton LTC Pharmacy

Morton LTC Pharmacy is an independent, fourth-generation family-owned pharmacy based in Wisconsin. The organization provides specialized pharmacy services that are tailored specifically for long-term care facilities, serving a critical role within the regional healthcare infrastructure.

Risk assessment and industry implications

This allegation may pose a significant risk to the confidentiality of patient data, given the organization's specialized operations within the healthcare sector. Because the entity is based in the United States, a potential data breach could trigger complex legal processes under HIPAA regulations, which govern the protection and privacy of sensitive patient health information.

Furthermore, such an incident can lead to secondary risks for both the organization's employees and its customers. These risks include the potential for identity theft or the execution of targeted phishing attacks. The method used by the threat actor to publish the data may be part of a double-extortion strategy. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten public disclosure, thereby increasing the pressure to pay a ransom.

For organizations operating in the healthcare sector, maintaining operational continuity is vital. Such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.