Pavlus Travel listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Hospitality
• Announcement date: February 10, 2026

Luxury travel provider Pavlus Travel targeted by pear ransomware group

Pavlus Travel, a provider of luxury travel services, has been listed on the leak site of the ransomware group known as pear. The threat actor claims to have gained access to the organization's systems, marking a new incident in the ongoing landscape of cyber extortion.

Details of the claimed attack

According to the announcement published on the pear leak site, the group claims to have successfully breached the systems of Pavlus Travel on February 6, 2026. The group subsequently posted an announcement regarding the organization on February 10, 2026. The threat actor continues its activities by threatening to publish the organization's data to exert pressure.

In modern cyberattacks, ransomware groups often utilize a method known as double extortion. In this scenario, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of releasing this stolen information on a public leak site serves as a powerful tool to coerce the victim into paying a ransom. This method increases the pressure on the target, as the leak of sensitive information can cause long-term reputational and legal damage that persists even if systems are restored from backups.

Data allegedly exfiltrated in the breach

The information shared in the post provides a general summary of the nature of the data involved in the incident. While the specific volume of data and the total number of files have not been disclosed, the group claims to have accessed several categories of sensitive information. The data allegedly exfiltrated includes:

• Customer information
• Booking details
• Payment information
• Corporate correspondence

The presence of such data types suggests that the breach may have access to highly sensitive personal and financial details. When attackers target such information, the stolen data could potentially be utilized in secondary attacks, such as phishing campaigns or identity theft, even if the initial ransomware demand is not met.

Organizational profile

Pavlus Travel is a travel agency specializing in luxury sea cruises, river cruises, and guided tours. Based in the US, the company provides personalized vacation planning services.

Impact and potential risks

This incident may pose risks of identity theft and financial fraud for Pavlus Travel customers. Because the organization is based in the United States, the breach may trigger legal processes under state-level data protection laws and federal regulations. Furthermore, the organization's operational processes may experience temporary disruptions depending on the scope of the leak.

For organizations operating within the hospitality and travel sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting customer data is paramount, as the loss of booking and payment information can lead to a significant loss of consumer trust. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, organizations often employ continuous monitoring and advanced detection tools to identify unauthorized access to sensitive networks before data exfiltration can occur.

Public information regarding the pear group remains limited, making it difficult to assess the full scope of their capabilities or their typical targets. As with many ransomware incidents, the threat of secondary exploitation remains a significant concern for the affected organization and its clients.