Angstrom Automotive Group listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Manufacturing
• Announcement date: December 15, 2025

Angstrom Automotive Group targeted by pear ransomware group

The threat group known as pear has listed Angstrom Automotive Group on its dedicated leak site. According to the announcement made by the group, a significant volume of data belonging to the organization has been exposed to the public.

The group claims that the breach occurred following an initial access event on December 1, 2025. The listing, which appeared on the group's leak site on December 15, 2025, alleges that the threat actors successfully exfiltrated 2.5 TB of data from the organization's systems.

Details of the alleged data exposure

While the exact nature of the files remains subject to the claims of the threat actor, the group has provided details regarding the types of information they have allegedly stolen. Based on the information provided by the group, the exposed data is quite diverse, covering various aspects of the company's operations and administrative functions.

The data types identified in the claim include:

• Employee records
• HR documents
• Technical drawings
• Technical data
• Customer correspondence
• Supplier correspondence
• Financial data

The exposure of such a wide range of information, spanning from sensitive human resources files to proprietary technical documentation, represents a significant breach of confidentiality for the targeted entity.

About Angstrom Automotive Group

Angstrom Automotive Group is a tier 1 full-service supplier operating within the manufacturing sector. The company specializes in providing solutions for metal forming and assembly. It serves as a critical link in the supply chain for automotive and industrial original equipment manufacturers (OEMs).

Potential impact and industry implications

This incident may negatively impact the organization's operational continuity and commercial reputation. The exposure of technical drawings and business correspondence could potentially harm the organization's competitive advantage by revealing proprietary processes or strategic communications.

Furthermore, the personal information allegedly leaked could increase the risk of identity theft or targeted phishing attacks for employees and business partners. Because the organization is a US-based entity, it may face legal proceedings under state-level data protection laws and industry regulations due to the nature of the exposed data.

In the broader context of modern cyber threats, this incident highlights the risks associated with double extortion tactics. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage during ransom negotiations. By threatening to leak the stolen information on a public site, attackers aim to pressure the victim into paying a ransom to prevent the release of sensitive corporate and personal data.

For organizations operating in the manufacturing and automotive supply chain sectors, such incidents underscore the importance of robust cybersecurity frameworks. Common defensive steps for organizations to mitigate these risks include implementing strict access controls, maintaining offline backups, and conducting regular security audits. Protecting technical intellectual property and sensitive correspondence is vital for maintaining a competitive edge in highly specialized manufacturing environments.

Public information regarding the pear group remains limited, making it difficult to determine the full scope of their typical operations or their specific motivations beyond the claims made in this instance.