Jordan Drug Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Jordan Drug was listed by the incransom ransomware group on May 16, 2025, after internal files were exfiltrated in a ransomware attack affecting an undisclosed number of people. Individuals connected to Jordan Drug should check for any notices or contact the organization to confirm whether their information was involved and take appropriate protective steps.
People who fill prescriptions or receive medical equipment through pharmacies in eastern Kentucky may have personal and health-related information caught up in a claimed cyber incident. On May 16, 2025, the ransomware group incransom listed Jordan Drug on its leak site, asserting that internal files had been taken. The number of people affected remains unknown, and public detail about the exact contents of those files is limited. For patients and local residents, the practical stakes involve the possible exposure of records that pharmacies routinely handle—information that can be used for identity misuse or targeted fraud if it surfaces.
This article sets out only what has been reported, places the claim in context, and outlines steps individuals can take while fuller confirmation is still pending.
Breaking down the breach
According to the available record, Jordan Drug was listed by the incransom ransomware group on May 16, 2025. The group claims that internal files were exfiltrated in a ransomware attack. No confirmed count of affected individuals has been published, and the method of initial access, the precise timing of the intrusion, and any ransom demand details remain undisclosed. The listing itself constitutes the group’s public assertion rather than an independently verified disclosure from the organization. Public reporting has not yet supplied further technical indicators or a formal statement confirming the full scope of the incident.
Who is incransom?
Incransom is a ransomware operation known for double-extortion tactics: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. Like other groups in this category, it typically posts victim names, sometimes with sample files or countdown timers, to increase pressure. Public tracking of such actors shows they target a range of mid-sized organizations across healthcare, retail, and professional services. In this case, the group claims Jordan Drug as a victim and states that internal files were taken; no additional claims specific to this listing—such as particular file volumes or dollar figures—appear in the provided facts. Listings of this kind should be treated as unverified assertions until corroborated by the affected organization or independent investigation.
About Jordan Drug
Jordan Drug, Inc. operates seven independent pharmacies across eastern Kentucky. The Jordan Drug Family Stores include Village Apothecary and Stufflebean Pharmacy in Beattyville, Owsley Prescription Center in Booneville, Wolfe Prescription Center in Campton, Powell Prescription Center in Clay City, Jackson Apothecary in Jackson, and Clinic Pharmacy in Salyersville. Jordan Medical, LLC was established by Luther and Rosemary Smith in September 2005 to serve patients in central and eastern Kentucky already being served by Jordan Drug, Inc., with respect to their durable medical needs. Organizations of this type sit at the intersection of retail pharmacy and durable medical equipment supply. They typically maintain patient profiles, prescription histories, insurance details, and contact information necessary to dispense medications and equipment. A breach involving such an entity is consequential because the data often combines health identifiers with financial and demographic details that are valuable to criminals and sensitive for the individuals involved.
What data was at risk
The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of those files—such as specific categories of personal data, medical records, or financial documents—has been disclosed. Organizations operating independent pharmacies and durable medical equipment services commonly hold patient names, addresses, dates of birth, prescription and refill records, insurance or billing information, and contact details for caregivers. Whether any of those categories were among the files claimed by incransom remains unconfirmed. Public detail is limited to the general description of “internal files.”
- Claimed exposure: internal files taken during a ransomware attack
- Number of people affected: unknown
- Specific data categories: not disclosed
- Confirmation status: listing by incransom; independent verification not provided in available facts
The real-world impact
For individuals whose information may have been involved, the primary risks are identity theft, prescription fraud, and phishing that leverages accurate personal or medical details. Even limited internal files can contain enough identifiers to open fraudulent accounts or to craft convincing social-engineering messages. For the organization, a ransomware incident can disrupt pharmacy operations, delay prescription fulfillment, and create regulatory notification obligations under health-privacy rules. Because the number of affected people is unknown and the exact data types remain unconfirmed, the scale of these risks cannot yet be quantified. Patients in the communities served by the seven pharmacies and by Jordan Medical, LLC have a legitimate interest in learning whether their records were among the claimed files and in taking basic protective steps in the meantime.
If your data was in this claimed breach
If you have been a customer of any Jordan Drug Family Store or have received durable medical equipment through Jordan Medical, LLC, treat the situation as a potential exposure until clearer information emerges. Monitor bank and insurance statements for unexpected activity, be cautious of unsolicited calls or emails that reference prescriptions or medical equipment, and consider placing a fraud alert with the major credit bureaus. Change passwords on any accounts that reuse credentials you may have shared with the pharmacy, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Keep records of any suspicious contacts and report confirmed fraud to the relevant authorities and your insurer. Further official notices from the organization, if issued, should be read carefully for tailored guidance.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
www.precipiodx.com Listed by incransom Ransomware Groupforensicmed.com Listed by incransom Ransomware Groupsensationalteeth.com Listed by incransom Ransomware Groupsuntreeinternalmedicine.com Listed by incransom Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Jordan Drug Listed by incransom Ransomware Group →
Publicly posted by incransom — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.