MORTON WILLIAMS Listed by everest Ransomware Group

On May 1, 2024, supermarket chain Morton Williams appeared on the leak site of the Everest ransomware group. The listing states that attackers exfiltrated 150 GB of internal files during a ransomware incident and published download links on two GoFile pages. Anyone who has shopped at the New York-area grocery stores, worked there, or had personal information processed by the company may now be affected.

Details in the Leak-Site Listing

The Everest leak page, accessible via the ransomware.live mirror at the onion address provided, states that Morton Williams was hit by a ransomware deployment. It explicitly lists 150 GB of data as exfiltrated and supplies two direct download links. The disclosure does not specify the exact types of files taken, nor does it quantify how many customer or employee records are included. The company’s own website, www.mortonwilliams.com, is referenced but no formal breach notification from Morton Williams has surfaced publicly at the time of this writing.

Why This Matters for You and Your Family

When a regional supermarket suffers a ransomware breach, the exposure often reaches far beyond corporate spreadsheets. Grocery chains routinely store names, addresses, phone numbers, email addresses, payment details, and employee payroll information. Even if the precise contents remain undisclosed, the 150 GB volume suggests a substantial trove. For ordinary families, this can translate into heightened risk of identity theft, phishing campaigns tailored to your shopping habits, or fraudulent accounts opened in your name. Children’s information tied to loyalty programs or family accounts can also surface, creating long-term privacy headaches.

The Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently contain spreadsheets that link customer loyalty numbers to real identities, employee directories with home addresses, or vendor contracts that expose additional contact details. Once attackers or opportunistic criminals obtain even fragments of this data, they can stitch together full identity profiles. A single email address or phone number from the Morton Williams breach can be correlated with gaming usernames, social-media handles, and other leaked credentials. This chaining effect turns one grocery-store breach into a gateway for account takeovers across unrelated services. Credential leaks like this one cascade into account takeovers and doxxing chains, especially when family members share passwords or linked devices.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware group’s emergence to late 2020. The collective has targeted healthcare providers, manufacturers, retailers, and local governments in the years since. Notable prior victims include organizations whose data appeared on the same leak site after similar double-extortion campaigns. Their typical playbook begins with initial access gained through phishing, remote-desktop compromise, or stolen credentials, followed by extensive network reconnaissance, data exfiltration, and then encryption. The group then posts samples on their leak site and demands payment to prevent full publication. The Morton Williams listing follows this pattern exactly, with the May 01, 2024 publication serving as the extortion pressure point.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you ever used at Morton Williams or its loyalty systems, then enable 2FA through an authenticator app on every account where that password was reused.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf while you focus on securing day-to-day accounts.

The Morton Williams breach is another reminder that ransomware operators continue to treat ordinary consumer data as leverage. Acting quickly on credential hygiene and identity mapping can limit how far this incident reaches into your life. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.