Medical Center, LLP listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: November 22, 2025

Medical Center, LLP, a healthcare provider based in the United States, has been listed on the leak site of the ransomware group known as pear. The threat actor claims to have successfully accessed data belonging to the institution, marking a potential significant security incident for the medical practice.

The claimed attack and group details

According to a post published on November 22, 2025, the threat actor known as pear claims to have accessed data belonging to Medical Center, LLP. The announcement indicates that the institution was targeted on November 19, 2025. The group has expressed its intention to release the data allegedly obtained from the institution's systems.

Information regarding the pear ransomware group remains limited in the public domain. In the current cyber threat landscape, ransomware groups often utilize leak sites to pressure victims. These sites serve as a platform where threat actors post announcements regarding their targets. This tactic is frequently associated with double extortion, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

Alleged data involvement

While the specific volume of the data or the exact number of files involved have not been disclosed by the group, the nature of the allegedly stolen information has been identified. Based on available screenshots, the data claimed to have been leaked includes several sensitive categories of information:

• Patient records
• Employee information
• Internal documents

The exposure of such data types is a common objective for ransomware groups targeting the healthcare sector, as these files often contain highly sensitive personal and professional details.

Organization profile

Medical Center, LLP is a family medicine and primary care practice located in Dublin, Georgia. The institution provides general medical care and family health services to its patients, serving as a primary point of contact for community health needs.

Impact assessment and sector implications

The claims made by the pear group pose a significant risk to patient privacy and data security for an institution operating within the healthcare sector. Because the organization is based in the United States, a potential data breach of this nature may trigger legal processes under HIPAA regulations, which govern the protection of sensitive patient health information.

The potential publication of the alleged data could facilitate various secondary crimes, such as identity theft or highly targeted phishing attacks directed at both patients and employees. Furthermore, the organization may face negative impacts regarding its operational continuity and its reputation management within the community.

In the broader context of healthcare cybersecurity, organizations often implement defensive measures to mitigate these risks. These typically include robust encryption for data at rest and in transit, multi-factor authentication to prevent unauthorized access, and continuous monitoring of network traffic to detect anomalous behavior. Additionally, maintaining regular, offline backups and conducting regular security awareness training for staff are standard practices to defend against the evolving tactics used by ransomware groups.

Evaluating the threat

The possibility of the threat actor attempting to demand a ransom through double extortion tactics is currently being evaluated. As is common with many ransomware incidents, the intersection of operational disruption and data exfiltration creates a complex crisis management scenario for the victimized entity.