Morton Drug Company discloses cybersecurity breach impacting 40,000 patients

Morton Drug Company, a Wisconsin pharmacy specializing in long-term care services, has disclosed a security incident that compromised the personal information of 40,051 individuals after unauthorized access to its IT systems was detected in August.

The company identified the intrusion on or around August 20, 2025. Cybersecurity specialists were brought in to investigate the activity, contain the incident, and support remediation efforts. Law enforcement was also notified. The investigation later confirmed that an unauthorized party had gained access to the company’s network.

A review was initiated to assess the impact on patient data. On or around October 21, 2025, Morton Drug Company determined that sensitive information had been exposed and may have been stolen. The data varied by individual and included names paired with addresses and prescription information. A subset of affected individuals also had their Social Security numbers involved.

No indications of data misuse have been identified, but impacted individuals have been urged to monitor their accounts and remain alert for potential identity theft or fraud. Morton Drug Company stated that multiple security enhancements have been implemented to prevent similar incidents.

The breach also involved personal information and protected health information that may have been acquired during the period of unauthorized access, consistent with findings from the company’s internal review. The law firm Lynch Carpenter LLP has begun reviewing potential claims connected to the incident and has invited affected individuals to seek a case evaluation through its website.

Morton Drug Company has confirmed that it continues strengthening its system safeguards as part of its broader response to the breach.