Next level medical, llc listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: August 26, 2026

Next level medical, llc targeted by pear ransomware group

The healthcare provider NEXT LEVEL MEDICAL, LLC has been listed on the leak site associated with the ransomware group known as pear. According to the announcement made by the threat actor, the organization has been targeted in a cyber incident. The listing appeared on the group's platform on August 26, 2026, and the group claims to have successfully obtained access to data belonging to the organization.

The threat actor, operating under the name pear, suggests that the breach occurred shortly before the public announcement. Specifically, the group claims that the incident took place on August 24, 2026. While the group has published this information on their leak site, the specific details regarding the volume of data stolen or the specific ransom demand have not been disclosed in the available announcement.

Details of the claimed data exfiltration

The announcement made by the pear ransomware group specifies the types of information that were allegedly exfiltrated during the attack. The threat actor claims to have obtained access to a variety of sensitive documents and personal information. According to the information shared in the post, the data allegedly exfiltrated includes:

• Personally Identifiable Information (PII)
• Patient records
• Financial documents
• Private data

In many modern ransomware attacks, threat actors employ a tactic known as double extortion. In this scenario, the attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this stolen information on a public platform serves as additional leverage to pressure the victim into paying a ransom. This method increases the pressure on organizations, as the exposure of sensitive data can lead to long-term reputational and legal consequences even if systems are successfully restored from backups.

About Next level urgent care

Next Level Urgent Care is a healthcare provider operating across Texas. The organization focuses on providing patients with accessible, affordable, and efficient medical treatment options. They offer urgent medical care and various health services to the community they serve.

Potential impact and industry implications

This incident may pose a significant risk due to the potential exposure of sensitive data within the healthcare sector. The publication of such data could lead to secondary risks for affected individuals, including identity theft and targeted phishing attacks. When private information, such as patient records and PII, is exposed, it provides malicious actors with the necessary components to conduct highly convincing social engineering campaigns against the individuals involved.

As the organization is based in the United States, the incident may result in legal and regulatory consequences under HIPAA regulations. Healthcare entities are subject to strict standards regarding the protection of patient privacy, and any unauthorized access to protected health information typically triggers mandatory reporting and investigation requirements. Furthermore, the organization may experience operational disruptions, which could potentially impact the supply chain. Such disruptions can affect the ability of a healthcare provider to deliver timely services to their patient base.

Information about the pear ransomware group remains limited, making it difficult to determine the full scope of their typical operations or their specific technical methodologies. For organizations in the healthcare sector, maintaining robust defensive postures is critical. This includes implementing strict access controls, continuous monitoring of network traffic for unusual data movements, and ensuring that all sensitive data is encrypted both at rest and in transit. Regular security audits and employee training are also essential components of a comprehensive cybersecurity strategy to mitigate the risks posed by such sophisticated threat actors.