Metropolitan Construction Systems listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Manufacturing
• Announcement date: July 24, 2026

Metropolitan Construction Systems targeted by pear ransomware group

The ransomware group known as pear has listed the New York-based company Metropolitan Construction Systems on its leak site. The group claims to have compromised the organization and subsequently leaked a significant amount of data. According to the announcement posted on July 24, 2026, the attackers claim to have exfiltrated 1.6 TB of data allegedly belonging to the institution.

The group, which has limited public information available regarding its identity and operations, claims to have gained access to the company's financial and operational data. This incident follows an alleged attack date of July 20, 2026. The group appears to be employing a double extortion tactic, a method where threat actors not only encrypt an organization's systems but also steal sensitive data to use as leverage. By threatening to publish this information on a public leak site, the attackers aim to exert maximum pressure on the victim to meet their demands.

Details of the alleged data breach

The announcement made by the pear group specifies a wide array of sensitive information that has reportedly been leaked. The scope of the data suggests a deep intrusion into the company's internal digital environment and cloud storage. The leaked information is said to include various types of records that could impact multiple stakeholders of the organization.

The specific data types mentioned in the leak site announcement include:

• Financial records
• HR data
• Customer information
• Vendor information
• Payment details
• Project drawings
• Email correspondence
• OneDrive data

The inclusion of such diverse data sets, ranging from internal human resources files to external vendor and customer information, highlights the potential breadth of the breach. The mention of OneDrive data specifically indicates that the attackers may have targeted cloud-based storage environments to expand the volume of stolen information.

About Metropolitan Construction Systems

Metropolitan Construction Systems is a company based in New York. The organization provides commercial roofing and construction solutions. They specialize in the installation and maintenance of roofing systems for commercial buildings, serving the needs of the commercial construction sector.

Impact and security implications

The scale and nature of the allegedly leaked data present significant risks to the organization and its associates. Given the types of information involved, there are heightened risks of identity theft and targeted phishing attacks directed at the institution's employees and customers. When personal and financial details are exposed, individuals often become targets for social engineering attacks designed to exploit the stolen information.

Furthermore, the exposure of trade secrets, such as project drawings, could harm the institution's competitive advantage and weaken the security of its supply chain. The loss of technical documentation and project-specific data can disrupt business operations and provide competitors with sensitive insights into the company's specialized processes.

Because Metropolitan Construction Systems is a US-based entity, this incident may trigger state-level data breach notification laws and potential legal sanctions. Organizations in the construction and manufacturing sectors often face these complexities when sensitive project and client data are compromised. To defend against such threats, organizations typically focus on strengthening their perimeter defenses, implementing robust access controls for cloud environments like OneDrive, and conducting regular security awareness training to mitigate the risk of phishing.