Clarkston First Baptist Church targeted by pear ransomware group

• Ransomware group: pear
• Country: United States
• Sector: Government & Defense
• Announcement date: August 5, 2025

The ransomware group known as pear has listed data allegedly belonging to Clarkston First Baptist Church on its leak site. This announcement, which appeared on August 5, 2025, indicates a potential data breach involving the historic institution located in the United States.

Details of the alleged attack

According to the claims made by the pear group, the group gained access to the systems of Clarkston First Baptist Church on June 26, 2025. The group subsequently added the organization to its leak site on August 5, 2025, as part of its public disclosure process. The post indicates that approximately 1 GB of data, allegedly obtained from the institution, is being leaked.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's data to demand a ransom for its release but also steal sensitive information before the encryption occurs. The stolen data is then threatened with public exposure on a leak site if the ransom is not paid. This pressure tactic aims to maximize the impact on the victim by threatening their reputation and legal standing through the release of private information.

Data involved in the leak

The information provided by the threat actor includes samples of various documents. Based on the available evidence, the following types of data are allegedly being leaked:

• Personally identifiable information (PII)
• Administrative forms
• Application documents

The presence of such documents suggests that the leaked material contains records that could be used to identify specific individuals associated with the institution.

About Clarkston First Baptist Church

Clarkston First Baptist Church is a historic Baptist church located in Clarkston, Georgia. It was founded in 1881 by former slaves and has since become a long-standing institution that provides community-focused religious services.

Analysis and implications

This incident suggests that there may be vulnerabilities in the institution's data security processes. The presence of personal data in the allegedly leaked documents could lead to secondary risks for the affected individuals, such as identity theft or fraud. Because the institution operates in the United States, legal processes may be triggered under state-level data protection laws and notification requirements.

Information about the pear group remains limited, and their specific motivations and methods cannot be fully determined from the available data. In such cases, organizations often face the challenge of managing both technical remediation and the legal complexities of data privacy regulations.

For organizations operating in similar sectors, maintaining robust security measures is essential to prevent unauthorized access. Common defensive steps include implementing multi-factor authentication, conducting regular security audits, and ensuring that all software is patched against known vulnerabilities. Furthermore, following a breach, it is often advisable for an institution to notify affected parties and conduct a thorough review of its security measures to prevent future incidents.