Colonial Presbyterian Church listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: April 10, 2026

Colonial Presbyterian Church targeted by pear ransomware group

Colonial Presbyterian Church has been listed on the leak site of the ransomware group known as pear. The threat actor claims to have gained access to the organization's systems and acquired various data. This announcement suggests that a cybersecurity incident may have occurred regarding the organization's digital assets.

Details of the claimed attack

The pear group listed Colonial Presbyterian Church on its leak site on April 10, 2026. According to the claims made by the threat actor, the unauthorized access to the organization's systems occurred around April 7, 2026. While the group has published a listing, specific details regarding the total size of the data stolen or the exact number of files involved have not been provided by the group.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak this data on a public site, the attackers aim to pressure the victim into paying a ransom. In this instance, the pear group has utilized their leak site to announce the breach, a common tactic used by modern ransomware operations to increase visibility and pressure.

Data involved in the leak

Based on the information provided in the leak site announcement, the breach involves several categories of sensitive information. The screenshots associated with the listing indicate that the following types of data have been leaked:

• Financial documents
• Tax forms
• Employee information
• Personal data

The presence of such diverse data types suggests a significant compromise of the organization's internal administrative and personal records. No information was provided regarding the specific ransom demand made by the attackers.

About Colonial Presbyterian Church

Colonial Presbyterian Church is a Christian church with two campuses located in Overland Park and South Kansas City. It conducts community-focused religious services and worship activities.

Risk assessment and organizational implications

This incident may pose risks such as identity theft and targeted phishing attacks for the organization's employees and members. When personal data and financial documents are exposed, individuals within the organization become prime targets for social engineering attacks, where criminals use stolen information to appear legitimate in fraudulent communications.

Given the nature of the leaked data, the organization may have obligations under state-level data protection regulations and privacy laws in the United States. Organizations facing such incidents often need to initiate a forensic investigation to determine the full scope of the leaked data and notify the affected parties. Such investigations are critical for understanding how the perimeter was breached and what specific vulnerabilities were exploited.

In the broader context of cybersecurity, organizations in the non-profit and religious sectors often face unique challenges. While they may not hold the same volume of transactional data as large retail entities, the highly personal nature of the data they manage—such as member information and employee tax records—makes them valuable targets for attackers seeking identity theft opportunities. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous backup protocols, and conducting regular security awareness training to mitigate the risk of initial access via phishing.

Public information about the pear group remains limited, making it difficult to attribute the attack to a specific geographic location or to understand the group's long-term objectives. As with many emerging ransomware groups, the lack of transparency regarding their operations adds a layer of complexity to the incident response and recovery process for the victimized organization.