Lewis Drug Listed by AiLock Ransomware Group

On July 6, 2025, Lewis Drug appeared on the leak site of the AiLock ransomware group. The South Dakota-based pharmacy chain, founded in 1942, is claimed to have had internal files exfiltrated during a ransomware attack. Public reporting indicates that customer and employee data may have been among the stolen material, though the exact number of affected individuals remains unknown.

Reported Details of the Breach

Available reporting describes the incident as a classic ransomware operation. Attackers gained access to Lewis Drug’s internal networks, encrypted systems, and then exfiltrated files before demanding payment. The group published proof of the theft on its leak site, a common pressure tactic when victims do not pay. No confirmed count of exposed records has been released, but pharmacy chains typically hold sensitive information including names, addresses, dates of birth, Social Security numbers, prescription histories, and payment details.

July 6, 2025 marks the public listing date. The breach itself likely occurred weeks earlier, following the pattern seen in most ransomware cases where operators quietly exfiltrate data before encryption and only publicize it after the deadline passes.

Why This Matters for You and Your Family

If you or anyone in your household has filled a prescription at a Lewis Drug pharmacy, your personal health and financial information could now sit in attackers’ hands. Pharmacy records are especially dangerous because they reveal medical conditions, insurance details, and sometimes family member information when dependents are covered under the same plan. Once stolen, this data can fuel identity theft, insurance fraud, or targeted scams that feel deeply personal.