Homsey Law Center listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: September 14, 2025

The threat actor known as pear has listed Homsey Law Center on its leak site, claiming to have exfiltrated data from the organization. This announcement, made on September 14, 2025, follows an alleged attack that occurred on August 4, 2025. The listing constitutes a claim of a data breach by the group, though the specific details regarding the volume of data or the ransom demand have not been provided.

The alleged attack and group activity

The threat actor pear has listed the Oklahoma-based law firm Homsey Law Center on its leak site, alleging a data breach. To support its claims, the group has posted various documents that it alleges were obtained from the firm's networks as evidence. While the group has made these claims public, information regarding the pear group remains limited, making it difficult to establish a comprehensive profile of their specific operations or motivations.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information. In many modern cyberattacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not just encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. This allows them to threaten the public release of private data if the ransom is not met, significantly increasing the pressure on the victim organization.

Claimed data and sensitive information

The screenshots provided by the threat actor as evidence of the breach display several types of sensitive documentation. The content of these files suggests that the stolen information is highly personal and related to the legal and financial matters handled by the firm. The types of documents identified include W-9 tax forms, legal correspondence regarding personal injury cases, client agreements, and medical record forms.

Based on the evidence presented by the group, the following categories of data are reportedly affected:

• Tax identification numbers
• Client legal correspondence
• Medical records
• Personally identifiable information

The exposure of such diverse data types, ranging from financial identifiers to medical records, highlights the sensitive nature of the information targeted during the alleged incident.

Organization profile

Homsey Law Center is a law firm specializing in personal injury law. The firm has been serving the Oklahoma City area for over 47 years.

Risk assessment and industry implications

The nature of the alleged leaked data may pose significant risks to client privacy and the firm's professional reputation. Because the organization is a law firm operating in the United States, this incident could lead to legal consequences under HIPAA or state-level data protection regulations. The exposure of medical records and personal identifiers often triggers strict regulatory oversight and reporting requirements to ensure consumer protections are maintained.

Furthermore, the documents exposed may be leveraged by malicious actors for identity theft or targeted phishing attacks. Such attacks often use the specific details found in legal or medical correspondence to craft highly convincing messages designed to deceive clients or employees. Secondary risks may also arise for the firm's supply chain partners and clients, as the breach of one entity can create a ripple effect of vulnerability across interconnected professional networks.

To defend against such threats, organizations in the professional services sector often implement various defensive measures. These include robust backup strategies to ensure data availability, multi-factor authentication to secure access to sensitive networks, and continuous monitoring to detect unauthorized exfiltration. Additionally, maintaining strict adherence to regulatory standards and conducting regular security assessments can help mitigate the impact of potential breaches and strengthen the overall security posture of the organization.