Atlantic National Trust listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Financial Services
• Announcement date: January 30, 2026

Pear ransomware group claims data breach at Atlantic National Trust

The ransomware group known as pear has officially listed Atlantic National Trust on its leak site. According to the announcement made on January 30, 2026, the threat actor claims to have exfiltrated data belonging to the organization. The group has indicated its intention to publish the data allegedly obtained from the organization's network.

This type of activity is characteristic of modern ransomware operations, specifically the double extortion model. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive information. By threatening to leak this data on a public or semi-public leak site, the attackers aim to exert maximum pressure on the victim to fulfill ransom demands. The use of leak sites serves as a public shaming mechanism to increase the visibility of the breach and the perceived risk to the victim's reputation and regulatory standing.

Details of the claimed attack

The announcement by the pear group references specific aspects of Atlantic National Trust's business operations. The threat actor's claims point toward the firm's activities in commercial real estate acquisition and management, as well as its operations involving commercial asset-backed loans. The listing suggests that the breach targets the core functional areas of the organization's financial services business.

While the group has claimed the attack occurred around January 26, 2026, the specific technical methods used to gain access to the network remain unknown. Information regarding the pear group itself is currently limited, leaving their specific motivations and technical capabilities uncertain at this time.

Alleged contents of the leaked data

Based on the information provided in the screenshot associated with the leak site announcement, the group claims to have obtained a variety of sensitive and confidential files. The data allegedly stolen from the network includes several categories of highly sensitive information that are critical to the functioning of a financial institution and the privacy of its clients.

The items identified in the claim include:

• Financial records
• Client information
• Loan documents
• Tax records

The presence of such diverse data types highlights the potential impact of the breach. When financial, tax, and client-related documents are compromised, the integrity of the organization's data management is called into question. No information was provided regarding the total size of the data exfiltrated or the specific number of files involved.

Potential impact and industry implications

This incident suggests that sensitive financial and commercial data within Atlantic National Trust may be at risk of exposure. Given the nature of the financial services sector, the leaked information could potentially lead to identity theft or targeted fraud attempts against the firm's clients. The exposure of client information and loan documents provides a roadmap for malicious actors to conduct sophisticated social engineering or financial fraud.

Furthermore, as the organization is based in the United States, a potential data breach could trigger legal consequences under various state privacy laws and federal regulations. Financial institutions are subject to strict regulatory frameworks designed to protect consumer data, and any confirmed breach of sensitive information often necessitates mandatory reporting and significant compliance scrutiny.

For organizations operating within the financial services sector, such incidents underscore the necessity of robust data security protocols. To mitigate the risks of exfiltration, industry experts generally recommend implementing comprehensive defensive measures. These include strict access controls to limit data exposure, continuous monitoring of network traffic to detect unauthorized data movement, and the encryption of sensitive data both at rest and in transit. Additionally, organizations often find it necessary to review their incident response plans and ensure that they have clear procedures for notifying affected parties in the event of a confirmed breach.