Skip to content
Ransomware

Arkansas Oral & Maxillofacial Surgeons listed by pear ransomware group

The threat actor known as pear claims to have exfiltrated data belonging to Arkansas Oral & Maxillofacial Surgeons.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: pear
  • Country: United States
  • Sector: Healthcare
  • Announcement date: April 10, 2026

The threat actor known as pear has claimed responsibility for a data breach involving Arkansas Oral & Maxillofacial Surgeons. According to an announcement made on the group's leak site, the organization's data has been targeted in a recent cyberattack.

Details of the alleged attack

The pear group officially listed Arkansas Oral & Maxillofacial Surgeons on its dedicated leak site on April 10, 2026. While the announcement was made on that date, the threat actor alleges that it successfully gained access to the institution's data earlier, specifically on April 7, 2026. Information regarding the specific identity and background of this threat group remains limited, as the group provides minimal public details about its operations.

This type of activity is characteristic of modern ransomware tactics, often involving double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. By threatening to publish this stolen data on a public leak site, the threat actors aim to exert maximum pressure on the victimized organization to meet their demands. Such public listings serve as a tool for coercion, leveraging the potential for reputational damage and legal scrutiny to force a settlement.

Claimed data types

The announcement made by the pear group suggests that the stolen information is highly sensitive. According to the claims made by the threat actor, the leaked data is alleged to include a variety of critical documents and personal information. The specific categories of data mentioned in the announcement include:

  • Financial documents
  • Patient records
  • Employee information
  • Identification documents
  • Medical reports

The presence of such diverse data types highlights the high-value nature of the target. When attackers target healthcare entities, they often seek out a combination of medical and personal identifiers that can be used for various malicious purposes.

About Arkansas Oral & Maxillofacial Surgeons

Arkansas Oral & Maxillofacial Surgeons is a healthcare provider located in Arkansas, United States. The practice specializes in oral, jaw, and facial surgery. As a medical facility, it offers a wide variety of surgical procedures and treatment services to its patients to address various oral and facial health needs.

Potential implications and sector risks

This alleged data breach may pose significant secondary risks to both the patients and the employees of the institution. The nature of the compromised data suggests that individuals involved could face risks such as identity theft and fraud. Because the stolen information includes identification documents and medical reports, the potential for misuse is high.

Furthermore, as the entity operates within the healthcare sector, the compromised data may fall under strict regulatory frameworks, such as HIPAA. This could potentially lead to significant legal consequences for the organization. The breach may also result in long-term negative impacts on the institution's operational processes and the privacy of its patients.

For organizations operating in the healthcare sector, such incidents underscore the necessity of robust defensive measures. Common defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee security awareness training to prevent initial access. Additionally, maintaining offline, immutable backups and implementing strong data encryption for both at-rest and in-transit data are critical steps to mitigate the impact of both data exfiltration and ransomware encryption. As seen in this case, the intent of the threat actor to publish the data is a direct attempt to create pressure through the threat of public exposure.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories