ARC Dialysis LLC listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: April 7, 2026

ARC Dialysis LLC listed on pear ransomware leak site

The independent dialysis service provider ARC Dialysis LLC has been listed on the leak site of the ransomware group known as pear. The threat actor claims to have successfully breached the organization's systems, leading to the alleged acquisition of various types of sensitive data. This announcement marks a potential significant security incident for the healthcare provider.

Details of the alleged attack

According to the announcement made by the pear group on April 7, 2026, the group claims to have gained unauthorized access to the systems of ARC Dialysis LLC. While the leak site announcement was posted in April, the group states that the actual incident or the initial access occurred around March 25, 2026. This gap between the intrusion and the public listing is a common occurrence in ransomware operations.

Ransomware groups often utilize a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed by the group, the presence of the organization on a leak site indicates that the attackers are moving into the extortion phase of their campaign.

Compromised data types

The threat actor has provided information regarding the nature of the data they claim to have stolen. Based on the screenshots provided by the group, the breach involves several categories of highly sensitive information. The specific data types mentioned in the claim include:

• Financial data
• Patient records
• Employee information
• Medical data

The inclusion of medical and patient records is particularly critical in a healthcare context, as these files often contain highly regulated personal information. No specific information was provided regarding the total volume of data stolen or the exact number of files involved.

Organization profile

ARC Dialysis LLC is an independent dialysis service provider based in the United States. The company offers dialysis treatment and related healthcare services for patients with kidney failure.

Potential impact and industry implications

This incident may be significant due to the risk of exposing sensitive data from an organization operating in the healthcare sector. The alleged compromise of patient and employee information could lead to legal consequences under regulations protecting health data, such as HIPAA. When healthcare providers are targeted, the sensitive nature of the data—which often includes medical histories and personal identifiers—increases the risk profile for both the organization and the individuals affected.

Affected individuals may face a risk of identity theft or targeted phishing attacks. Once personal and medical information is leaked, it can be used by other malicious actors to conduct highly convincing social engineering campaigns. Furthermore, the organization may experience operational disruptions, which could potentially trigger secondary risks. Such disruptions can impact the ability to provide continuous care, which is vital in specialized medical services like dialysis.

In the broader cybersecurity landscape, organizations in the healthcare sector are frequent targets for ransomware groups due to the high value of medical records and the critical nature of their operations. To defend against such threats, organizations typically implement defensive measures such as multi-factor authentication, regular security awareness training, and robust data encryption. However, the limited public information regarding the pear group makes it difficult to assess the specific tactics, techniques, and procedures used in this particular attack.