GFF&F - Galine, Frye, Fitting & Frangos, LLP listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: October 17, 2025

The US-based law firm GFF&F - Galine, Frye, Fitting & Frangos, LLP has been listed on a leak site operated by the threat actor known as pear. The threat actor claims to have successfully compromised the firm's systems, leading to a potential data breach involving sensitive legal and personal information.

The claimed attack and event details

According to the announcement made by the pear group on October 17, 2025, the threat actor claims to have gained unauthorized access to the systems of GFF&F - Galine, Frye, Fitting & Frangos, LLP on October 14, 2025. This timeline suggests that the attackers may have maintained presence within the network for several days prior to the public listing on the leak site.

Publicly available information regarding the pear group remains limited, making it difficult to ascertain the full scope of their operations or their specific methodologies. In many modern ransomware scenarios, threat actors utilize a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to publish it on public leak sites to pressure the victim into paying. This method significantly increases the pressure on the target organization, as the threat of public exposure can lead to severe reputational and legal consequences.

The data allegedly involved in the breach

The information shared by the threat actor, which reportedly includes screenshots, suggests that the stolen data is highly sensitive. The claim indicates that the breach encompasses a wide variety of files essential to the firm's operations and its clients' privacy. The following types of information are alleged to have been compromised:

• Client information
• Personally Identifiable Information (PII)
• Court documents
• Contracts
• Correspondence
• Corporate data
• Private and confidential data

While the specific volume of the data and the exact number of files stolen have not been disclosed by the threat actor, the nature of the listed items points toward a significant breach of confidentiality. The presence of PII and legal documents is particularly critical in the context of professional services.

Organization profile

Galine, Frye, Fitting & Frangos, LLP is a law firm based in San Mateo, California. The firm specializes primarily in personal injury cases, a sector that inherently involves handling highly sensitive medical, personal, and legal documentation.

Implications and industry considerations

This claim of a data breach poses significant risks regarding client confidentiality and the principle of attorney-client privilege. Because the target is a law firm, the presence of sensitive personal and legal information could expose individuals to various secondary risks, such as identity theft or highly targeted phishing attacks. When attackers possess detailed correspondence and court documents, they can craft much more convincing social engineering campaigns against both the firm's employees and its clients.

As the firm operates within the United States, such an incident may trigger various state-level data protection laws and potentially lead to regulatory investigations. Organizations in the legal sector often face strict notification obligations toward their clients when a breach occurs. Failure to manage these obligations effectively can lead to substantial reputational damage and complex legal proceedings.

To defend against such threats, organizations in the professional services sector typically focus on robust defensive measures. These include implementing multi-factor authentication (MFA) across all access points, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular security awareness training to help employees recognize phishing attempts. Furthermore, maintaining offline or immutable backups is a critical component of a resilient incident response strategy, ensuring that data can be recovered even if primary systems are compromised. Given the threat of double extortion, organizations are increasingly prioritizing data loss prevention (DLP) tools to monitor and restrict the unauthorized movement of sensitive information out of the network.