Ramar & Paradiso listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: September 14, 2025

The pear ransomware group claims responsibility for the breach

The law firm Ramar & Paradiso has been listed on the leak site of the ransomware group known as pear. According to the announcement, the group claims to have obtained data from the firm, marking a significant potential breach of sensitive professional information.

The announcement was made on the group's leak site on September 14, 2025. The group's claims refer to an attack that is said to have occurred on August 8, 2025. While the group has published the organization's name, they have not provided information regarding the total size of the data stolen, the specific file count, or a specific ransom demand.

In modern cyberattacks, ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to publish this stolen information on public leak sites, the attackers aim to exert maximum pressure on the victim organization to pay the ransom. The publication of documents related to a firm's legal operations is a common method used by such groups to increase the perceived urgency and pressure of the situation.

Data types identified in the leak

The screenshots provided by the group suggest that the stolen information is highly sensitive and covers various aspects of the firm's operations and client matters. The leaked content reportedly includes a variety of documents that could lead to significant privacy violations for the individuals involved.

The following data types have been identified in the leaked content:

• Legal correspondence
• Financial statements
• Tax forms (W-9)
• Personal photographs

The presence of such diverse data types highlights the potential impact of the breach on both the firm's internal operations and the private lives of its clients and associates.

About Ramar & Paradiso

Ramar & Paradiso is a law firm specializing in medical malpractice defense, health care law, corporate law, contract disputes, and appeals. Given the nature of their practice, the firm handles highly confidential information related to legal proceedings, medical matters, and corporate interests.

Risk assessment and implications for the legal sector

This incident may pose a high risk due to the potential exposure of sensitive client data held by law firms. Because the organization is based in the United States, the breach may lead to legal consequences under HIPAA and state-level data protection regulations. The exposure of such data often triggers mandatory reporting requirements and significant regulatory scrutiny.

The specific nature of the leaked files introduces several layers of risk. The presence of tax forms among the leaked data could increase the likelihood of identity theft for the affected individuals. Furthermore, the publication of personal photographs may cause direct harm and reputational damage to the individuals involved. For a professional services firm, the loss of confidentiality regarding legal correspondence and financial statements can undermine client trust and jeopardize ongoing legal matters.

While information about the pear group remains limited, their motivation appears to be the exertion of ransom pressure through data leakage. Organizations in the professional services sector, particularly law firms, often face these types of targeted threats. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining strict access controls, conducting regular security awareness training, and ensuring comprehensive data encryption for both at-rest and in-transit states. Additionally, maintaining offline, immutable backups is a critical component of a resilient cybersecurity posture to defend against ransomware-driven encryption and extortion.