Law Office of Ronald W. Hillberg listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: November 17, 2025

The Law Office of Ronald W. Hillberg has been listed on the leak site of the ransomware group known as pear. The group has issued an announcement alleging that the organization has been the victim of a data breach.

The alleged attack and group claims

According to the announcement posted by the pear group, the Law Office of Ronald W. Hillberg was subjected to a cyberattack on November 12, 2025. The claim was officially made public on the group's leak site on November 17, 2025. While the group has taken responsibility for the incident, information regarding this specific threat actor remains limited in the public domain.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. These sites often host lists of compromised organizations to increase visibility and shame the target. In many modern ransomware campaigns, attackers utilize a tactic known as double extortion. In this scenario, the threat actors do not just encrypt the victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. This allows them to threaten the public release of stolen information if the ransom is not met, significantly increasing the pressure on the organization.

Alleged exfiltrated data

The claims made by the pear group suggest that a variety of sensitive information was exfiltrated during the attack. Based on the information provided in the leak site announcement, the following types of data are alleged to have been stolen:

• Client information
• Legal correspondence
• Confidential documents

The presence of such sensitive information in the hands of unauthorized actors presents significant risks to the affected parties.

Impact and potential consequences

The allegations of a data breach at a law firm carry serious implications. These claims may pose a direct risk to client confidentiality and the established principle of attorney-client privilege. Because the Law Office of Ronald W. Hillberg is a United States-based organization, the incident may trigger legal proceedings under various state-level data protection laws and professional ethical standards that govern the legal profession.

Furthermore, the nature of the stolen data suggests several potential secondary risks. The exfiltrated information could potentially be utilized by malicious actors for identity theft or for conducting highly targeted phishing attacks against the firm or its clients. When attackers possess legal correspondence and confidential documents, they can craft much more convincing social engineering campaigns.

Organizational response and defensive considerations

Given the sensitive nature of the data held by law firms, organizations in this sector often face complex recovery and notification requirements. It is possible that the organization may need to notify its clients regarding the breach and fulfill necessary legal reporting requirements mandated by law.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust backup solutions to ensure data availability, strict access controls to limit the exposure of sensitive files, and continuous monitoring to detect unauthorized data exfiltration. Additionally, implementing encryption for data at rest and in transit can help mitigate the impact if a breach does occur. Following established incident response plans is a critical step for any organization facing a confirmed or alleged ransomware event.