Cheyney University listed on pear ransomware leak site
The threat actor group known as pear claims to have leaked data belonging to Cheyney University on its leak site.
- Published
- 3 min read
- 3 min read
- Ransomware group: pear
- Country: United States
- Sector: Education
- Announcement date: September 14, 2025
The threat actor group known as pear has claimed responsibility for a data breach involving Cheyney University. On September 14, 2025, the group listed the institution on its dedicated leak site, alleging that they have successfully exfiltrated sensitive information belonging to the university.
Details of the alleged breach
According to the announcement made by the pear group, the unauthorized access to the institution's network may have occurred as early as August 18, 2025. The threat actor claims to have obtained a variety of sensitive documents through this intrusion. While the group has posted an announcement regarding the data leak, they have not provided information regarding the total size of the data stolen or the specific number of files involved. Additionally, no ransom demand has been made public in the current listing.
The group's claims suggest a targeted operation aimed at gathering sensitive administrative and personal information. In many modern ransomware scenarios, threat actors employ a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak this information on public forums or leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the public exposure of private records.
Data types involved in the leak
The threat actor has provided samples that purportedly show the nature of the stolen information. Based on the available evidence and the group's claims, the following types of data are reportedly involved in the breach:
- Financial records
- Personnel information
- Student records
- Driver's license information
- Social Security numbers
The presence of highly sensitive identifiers, such as Social Security numbers and driver's licenses, significantly increases the severity of the incident. Such data is highly valuable on illicit markets and can be used for various forms of identity fraud.
Organization profile
Cheyney University is a higher education institution located in Pennsylvania, United States. It holds the distinction of being the nation's first Historically Black College and University (HBCU).
Impact and security implications
The exposure of the aforementioned data types poses significant risks to the individuals involved. The leak of personal identifiers, such as Social Security numbers and driver's licenses, may expose students and staff to heightened risks of identity theft. Furthermore, the nature of the exposed personal data may increase the likelihood of targeted phishing attacks, where attackers use specific personal details to craft convincing fraudulent communications to trick individuals into revealing even more sensitive information.
From a regulatory perspective, because the institution is based in the United States, this incident could trigger legal obligations under the Family Educational Rights and Privacy Act (FERPA) and various state-level data protection regulations. Such frameworks are designed to protect the privacy of student educational records and mandate specific responses to data breaches. Additionally, the institution's reputation could be negatively impacted by the public disclosure of the breach.
For organizations operating within the education sector, this incident highlights the importance of robust cybersecurity defenses. Common defensive steps to mitigate such risks include implementing multi-factor authentication (MFA) across all administrative and student-facing portals, maintaining strict network segmentation to prevent lateral movement by attackers, and conducting regular security awareness training for staff and students. Continuous monitoring of network traffic and maintaining comprehensive, encrypted backups are also essential components of a modern security posture to defend against evolving ransomware threats.
Information regarding the specific capabilities and motives of the pear group remains limited at this time.