Jordan Drug Listed by incransom Ransomware Group

On May 16, 2025, Jordan Drug, Inc. appeared on the leak site of the incransom ransomware group. The company, which runs seven independent pharmacies across eastern Kentucky, had internal files stolen during a ransomware attack. Customers, employees, and anyone whose prescription records, insurance details, or personal health information passed through Village Apothecary, Stufflebean Pharmacy, Owsley Prescription Center, Wolfe Prescription Center, Powell Prescription Center, Jackson Apothecary, or Clinic Pharmacy may now be at risk.

What Public Reporting Shows

Public reporting indicates that Jordan Drug, Inc. and its affiliated entity Jordan Medical, LLC had data exfiltrated. The company was founded in 2005 by Luther and Rosemary Smith to provide both pharmacy services and durable medical equipment to patients in central and eastern Kentucky. Available reporting describes the exposed material as internal files, though the precise volume and exact contents have not been independently verified by third parties. The incident follows the group’s typical pattern of posting victim data on its dark-web leak site after encryption and failed ransom negotiations.

Why This Matters for You and Your Family

If you or your family filled prescriptions, submitted insurance claims, or received medical equipment at any of these locations, your names, addresses, dates of birth, Social Security numbers, prescription histories, and payment information could be in the stolen files. Health data is especially sensitive: it can be used for insurance fraud, prescription forgery, or targeted scams that sound legitimate because the caller already knows your medications and conditions. Unlike a credit-card breach, you cannot simply cancel your medical history. Once it is out there, it stays out there.

The Doxxing and Identity-Chain Implications

Stolen pharmacy records rarely stay isolated. Attackers combine names, addresses, and phone numbers with usernames found on other sites to build a complete picture of your digital life. A single leaked email can link your pharmacy account to social-media profiles, children’s gaming accounts, and school forms. This creates an identity chain that makes doxxing, harassment, and account takeovers far easier. Credential leaks like this one often cascade into gaming platforms where children reuse passwords or email addresses, exposing the entire household to further compromise.

Incransom’s Publicly Known Track Record

Public reporting attributes the attack to the incransom ransomware group. The group emerged in late 2024 and has targeted mid-sized businesses, healthcare providers, and local service companies. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, encrypting victim systems, exfiltrating data before triggering the ransomware, then demanding payment while threatening to publish the stolen files on its leak site. Notable prior victims include other regional healthcare and retail entities, though exact details remain limited in open sources.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Jordan Drug breach.
• Rotate any password you ever used at Jordan Drug or its pharmacies anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The breach of a local pharmacy chain shows how quickly everyday medical interactions can expose your family to long-term identity risks. Taking concrete steps now limits what attackers can build from this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—practical protection when credential leaks like this one begin to spread.