Gordon Clifford Properties Inc. targeted by Pear ransomware group

• Ransomware group: Pear
• Country: United States
• Sector: Professional Services
• Announcement date: December 15, 2025

The Pear ransomware group has officially listed Gordon Clifford Properties Inc. on its leak site, claiming to have successfully executed a data breach against the organization. According to the announcement posted on December 15, 2025, the threat actors allege they have obtained a significant volume of data from the company's network. This development follows a claimed attack date of December 11, 2025.

Details of the alleged breach

The threat actor known as Pear has published an announcement on its dedicated leak site, alleging a significant breach of Gordon Clifford Properties Inc. The group claims to have exfiltrated 10 GB of data from the organization's internal network. While the group has made this public claim, information regarding the specific identity and technical background of the Pear group remains limited, as is common with many emerging ransomware entities.

Ransomware groups often utilize leak sites as a tool for double extortion. In this tactic, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly if a ransom is not paid. By publishing a victim's name on a leak site, the group exerts psychological and reputational pressure on the organization to comply with their demands. While the specific ransom demand for this incident has not been disclosed, the act of listing the company serves as a primary method of coercion.

Compromised data types

The announcement made by the Pear group specifies that the stolen information is highly sensitive, potentially impacting various stakeholders within the organization's ecosystem. The group claims that the following types of data are among the compromised files:

• Financial data
• HR data
• Property owner information
• Tenant information

The inclusion of such diverse data types suggests that the attackers may have gained access to various administrative and operational segments of the corporate network.

About Gordon Clifford Properties Inc.

Gordon Clifford Properties Inc. is a professional services firm operating within the property management sector. Based in San Francisco, the company provides specialized management services to property owners throughout the region. Given the nature of their business, the organization handles a high volume of sensitive information related to real estate assets and the individuals associated with them.

Potential impact and industry implications

This alleged breach may pose a significant risk of exposure for the personal data held by the organization during its standard property management operations. Because Gordon Clifford Properties Inc. is based in the United States, the incident may trigger legal processes and regulatory scrutiny under relevant state laws and data protection regulations. The potential exposure of sensitive information often necessitates complex legal and compliance evaluations to determine the extent of the impact on regulated data.

The data allegedly leaked could be utilized by malicious actors for various secondary purposes, such as identity theft or highly targeted phishing attacks against the individuals involved. When personal information like tenant or owner details is compromised, the secondary impacts on the organization's clients and employees can be substantial and long-lasting. Such attacks often extend beyond the initial victim, creating a ripple effect of risk for all parties whose data was processed by the organization.

For organizations operating in the professional services and property management sectors, maintaining robust cybersecurity postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Furthermore, segmenting networks to prevent lateral movement and ensuring comprehensive logging and monitoring can help detect and mitigate unauthorized access before large volumes of data can be exfiltrated. As the threat landscape evolves, organizations must remain vigilant against the pressure tactics employed by ransomware groups through public data disclosure.