Kalchschmid GmbH & Co. KG listed on pear ransomware leak site

• Ransomware group: pear
• Country: Germany
• Sector: Manufacturing
• Announcement date: August 5, 2025

German manufacturing firm Kalchschmid GmbH & Co. KG targeted by pear ransomware group

The German manufacturing company Kalchschmid GmbH & Co. KG has been listed on the leak site associated with the pear ransomware group. This listing follows claims made by the threat actor that they have successfully compromised the organization's network and exfiltrated various documents.

Details of the alleged breach

According to the announcement published on August 5, 2025, the threat actor known as pear claims to have gained unauthorized access to the company's network. The group alleges that this access allowed them to steal a variety of documents belonging to the organization. The group has indicated that they intend to release the stolen data publicly starting from the date the announcement was posted.

While the specific volume of data and the exact number of files taken remain unknown, the group has provided samples of the alleged stolen information to support their claims. These samples include a variety of sensitive documents that fall into both corporate and personal categories. The leaked information is said to include:

• Identity information
• Official correspondence
• Accident reports
• Employment contracts

About Kalchschmid GmbH & Co. KG

Kalchschmid GmbH & Co. KG is a family-owned company based in the town of Balzhausen, Germany. The firm specializes in several construction and craftsmanship fields, including wood construction, carpentry, tin work, roofing, and scaffolding. The organization is known for combining traditional craftsmanship with modern construction techniques to serve its clients.

Potential impact and organizational risks

The alleged leak of such sensitive information poses significant secondary risks to the organization. For the employees and customers of Kalchschmid GmbH & Co. KG, the exposure of identity information and employment contracts could lead to risks such as identity theft and the execution of targeted phishing attacks. Such attacks often leverage stolen personal details to gain further trust during social engineering attempts.

Furthermore, because the organization operates within Germany, the disclosure of this data may fall under the scope of the European Union's General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on how personal data is handled, and a breach of this nature could potentially lead to administrative sanctions for the company. From a business perspective, the disclosure of operational data or trade secrets could negatively impact the competitive position of a manufacturing firm in its industry.

Regarding the threat actor, public information concerning the pear group is currently limited, leaving their specific methods and motivations unclear. In scenarios involving ransomware and data leaks, organizations often face the challenge of double extortion, where attackers not only encrypt systems but also threaten to release sensitive data to pressure the victim into paying a ransom. To mitigate such risks, it is generally considered important for organizations to fulfill their data breach notification obligations and ensure that all affected parties are properly informed of the incident.