CTI & Coordinators listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Transportation
• Announcement date: March 5, 2026

A new victim listed on a ransomware leak site

The ransomware group known as pear has listed the United States-based transportation firm CTI & Coordinators on its dedicated leak site. This announcement, made on March 5, 2026, constitutes a claim of a significant data breach against the organization. According to the threat actor, the compromise occurred on March 2, 2026. The group has indicated its intention to exert pressure on the organization by threatening to publish the stolen information.

Details of the alleged attack

The threat actor, pear, claims that the organization was successfully compromised. While specific details regarding the method of entry or the exact timing of the exfiltration have not been provided, the group is using the threat of data publication as a primary lever for extortion. This tactic is a hallmark of modern ransomware operations, where the goal is not just to encrypt systems, but to weaponize sensitive information to force a ransom payment.

The group's announcement suggests a targeted operation aimed at extracting sensitive information from the company's infrastructure. By listing the company on a public leak site, the group aims to maximize visibility and damage the organization's reputation to increase the likelihood of a successful extortion attempt.

Alleged data exfiltration and affected information

The announcement made by pear alleges that various types of sensitive information were exfiltrated from the organization's network. While the specific volume of the data and the total number of files involved remain unknown, the group has provided a general list of the categories of information they claim to possess. The data types mentioned in the claim include:

• Private data
• Employee data
• Operational data

The provided screenshots associated with the leak site listing contain a general list of these data types, though they do not provide a granular breakdown of individual files or specific records. The presence of employee and operational data suggests that the breach may impact both internal administrative functions and external business relationships.

About CTI & Coordinators

CTI & Coordinators is a logistics company that provides freight transportation services. The organization maintains an operational presence throughout the United States and also serves the province of Ontario, Canada.

Impact assessment and industry implications

This incident may negatively impact the operational continuity and reputation of CTI & Coordinators. The allegedly compromised data, which includes employee and operational information, could facilitate secondary malicious activities such as identity theft or targeted phishing attacks directed at the organization's employees and business partners.

Because the organization operates within the United States, it may face various notification obligations under relevant state laws and data protection regulations following a confirmed breach. The specific legal requirements for reporting such an incident depend on the nature of the data and the jurisdictions in which the affected individuals reside.

Information regarding the pear group remains limited. However, given that ransomware groups typically employ double extortion tactics—whereby they both encrypt data and threaten to leak it—the risk of data publication remains a significant concern for the victim. In the transportation and logistics sector, such incidents can disrupt supply chains and erode trust with clients.

Organizations in this sector often implement defensive measures to mitigate these risks, such as robust access controls, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Maintaining a comprehensive incident response plan is also a critical component of modern cybersecurity resilience.