DisclosureLens
GLOBALMalwareProfessional ServicesProfessional ServicesRansomwareAkiraRansom DemandedActor NamedMedium

Morton LTC

bd_3fe05c1ded328c0b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Filed

Nov 28, 2025

To disclose

Affected

Not disclosed

Confidence

50%
Full breach record for Morton LTC

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Akira on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: Business ServicesDiscovered: 2025-11-28

Source: Ransomware.live

Post text · scraped from the leak site

We obtained about 22gb of the following companies: Morton LTC Home specializes in providing pharmacy solutions tailo red for long term care providers. Reed Pope is a leading business law firm based in Victoria, Briti sh Columbia, specializing in business law, land development, and real estate law. American Public Television (APT) is a distributor of public telev ision programming that has introduced iconic shows and personalit ies such as Julia Child and Fred Rogers. LBenchmark Connector Corporation specializes in providing high-qu ality connectors for various industries, including military and a erospace applications. Radtke Contractors specializes in pile driving, marine and excava ting contracting, their varied experience in snow removal, bridge , and railroad construction allows us to complete a wide range of projects in commercial, municipal and residential construction m arkets. You will find personal employees and customer information, lots o f projects, agreements and contracts and other sensitive files. S ome cases contain legal confidential files.

Incident timeline — mostly unverified

? — ?

Breach window unknown

Nov 28, 2025

Claim posted

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Claim → filing

Compliance clock

Not assessable

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

Evidence ladder

Leak-site claimThis record

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.

Source ceiling

  • actor name
  • victim claim
  • ransom/leak status
  • discovery date
  • materiality
  • notification
  • affected count
  • confirmed data types
  • compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this groupFirst seen 2023-04-12

akira

According to ransomware.live, The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others. According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware. The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast. Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files. Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only). Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified. Source: https://github.com/crocodyli/ThreatActors-TTPs

1,799 tracked hereFull profile →