Morning Star Tours listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Hospitality
• Announcement date: May 4, 2026

The threat actor known as pear has listed the United States-based travel agency Morning Star Tours on its leak site. The announcement, which was discovered on May 4, 2026, indicates a data breach involving the organization. While the listing is a claim made by the threat actor, it marks a significant development in the ongoing targeting of the hospitality sector by ransomware groups.

The claimed attack and event details

According to the information provided by the pear group, the organization was targeted in a cyberattack that allegedly occurred on April 30, 2026. The group claims to have successfully obtained data belonging to Morning Star Tours and has subsequently published the organization's name on its dedicated leak site to signal the breach.

Ransomware leak sites serve as a platform for threat actors to exert pressure on their victims. These sites are often used to host lists of compromised organizations, sometimes accompanied by samples of stolen data. In many modern ransomware campaigns, actors employ a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive information. The threat actors then threaten to leak this stolen data on their public sites if the ransom demands are not met, creating a secondary layer of pressure on the victim organization.

Data types allegedly involved in the leak

The information associated with the claim suggests that a wide variety of sensitive documentation and information has been compromised. Based on the details provided in the leak site announcement, the following types of data are claimed to have been leaked:

• Financial data
• Customer information
• PDF documents
• Contracts
• Employee data
• Correspondence

The nature of these data types suggests a broad compromise of both corporate and personal information. When such diverse datasets are targeted, it often indicates that the attackers have gained access to various layers of the organizational network, ranging from administrative files to client-facing databases.

Organization profile

Morning Star Tours is a travel and tourism agency based in the United States. The company provides various vacation packages and personalized travel experiences to its customers.

Impact and industry implications

This incident may pose significant risks of identity theft and targeted phishing for the organization's customers and employees. The exposure of personal and financial information often leads to secondary attacks where criminals use the stolen details to craft highly convincing fraudulent communications aimed at the individuals involved.

As a United States-based entity, the organization may be subject to state-level data breach notification laws as well as various relevant sectoral regulations. The nature of the leaked data could have negative impacts on the organization's commercial reputation and may jeopardize supply chain security. The exposure of contracts and correspondence can also lead to legal and operational complications.

In the hospitality and travel sector, maintaining the trust of customers is paramount. A breach of this nature can damage the reputation built through personalized service and travel experiences. Organizations in this sector can mitigate such risks by implementing robust security frameworks, ensuring strict access controls, and maintaining comprehensive encryption protocols for sensitive data at rest and in transit. Furthermore, because public information regarding the pear group remains limited in the public domain, organizations must remain vigilant against evolving tactics used by such actors.