Poe's Accounting Services listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Financial Services
• Announcement date: November 17, 2025

Ransomware group pear claims attack on Poe's Accounting Services

The ransomware group known as pear has listed the US-based accounting firm Poe's Accounting Services on its leak site. In an announcement published on November 17, 2025, the group claimed to have targeted the institution, alleging that they successfully exfiltrated approximately 12 GB of data from the organization's network. This incident follows a claimed period of unauthorized access that began on November 13, 2025.

The group's announcement follows a common pattern observed in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also focus on stealing sensitive information. By threatening to release this stolen data publicly on a leak site, the attackers aim to increase the pressure on the victim to pay a ransom. While the ransom demand for this specific incident has not been disclosed, the threat of public exposure remains a central component of the group's tactic.

Details of the alleged data exfiltration

According to the information provided by the pear group, the breach involves a significant volume of sensitive documentation. The group alleges that the stolen data includes various types of highly confidential information that could be used to harm both the organization and its clients. The leaked material is said to consist of the following:

• Client records
• Tax returns
• Bank details
• Employee information
• Internal correspondence

The presence of such diverse data types—ranging from financial records to internal communications—highlights the potential impact of the breach. When attackers gain access to a network, they often seek out high-value targets such as tax documents and bank details to maximize their leverage during negotiations. The specific contents of the alleged leak have been presented via screenshots, which the group uses to validate their claims to the public.

About Poe's Accounting Services

Poe's Accounting Services is a firm based in the United States that specializes in accounting and the preparation of tax returns. The organization provides a variety of professional services to its clientele, including financial consulting and comprehensive accounting solutions. Their service model caters to both individual clients and corporate entities, meaning the data they manage is inherently sensitive and contains a mix of personal and business-related financial information.

Risk assessment and industry implications

This incident indicates a high risk of exposure for the sensitive financial data held by Poe's Accounting Services. Because the organization is a US-based entity, the breach may trigger various legal obligations. Depending on the nature of the data and the residency of the affected clients, the institution may face mandatory notification requirements under relevant state laws and federal regulations. The exposure of such information can lead to significant secondary risks for the victims, including the potential for identity theft and various forms of financial fraud.

Furthermore, because Poe's Accounting Services provides specialized tax and accounting services, the stolen data could potentially be utilized by malicious actors to conduct highly targeted phishing attacks. Such attacks often use specific details found in tax returns or internal correspondence to gain the trust of the victim, making the fraud much harder to detect.

Regarding the threat actor, public information concerning the pear group remains limited. Consequently, their specific operational methods, technical capabilities, and underlying motivations remain unclear. For organizations operating within the financial services sector, this incident serves as a reminder of the importance of robust defensive measures. Common industry practices to mitigate such risks include implementing multi-factor authentication, maintaining strict network segmentation, and ensuring comprehensive encryption for data at rest and in transit. Continuous monitoring and regular security audits are also essential to detect unauthorized access before large-scale data exfiltration can occur.