Rescue Mission Alliance listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Government & Defense
• Announcement date: September 14, 2025

The threat actor known as pear has listed the Rescue Mission Alliance on its leak site. The group claims to have gained unauthorized access to the systems of the organization, alleging that they have obtained various pieces of sensitive information. This announcement was posted on September 14, 2025, and the threat actor asserts that both operational and personal data belonging to the organization have been exposed.

The claimed attack and data exposure

According to the announcement made by the pear group, they have successfully infiltrated the systems of the Rescue Mission Alliance. The group claims that the breach occurred around August 25, 2025. While the group has published a listing, public information regarding the specific details and identity of this threat actor remains limited in the public domain.

The threat actor alleges that the breach resulted in the exposure of significant amounts of sensitive information. Based on screenshots provided by the group, the leaked content reportedly includes various types of documentation that could impact the organization's internal operations and privacy. The specific categories of data mentioned in the leak include:

• Financial data
• Board member information
• Bank account information
• Personal data

The presence of these files, which allegedly include financial statements, bank account statements, and information regarding board members, suggests a significant breach of organizational confidentiality. Furthermore, the group has shared screenshots that appear to show photos from internal meetings, adding a layer of privacy concern for the individuals involved.

The organization profile

The Rescue Mission Alliance is a Christian-based non-profit organization. It focuses on providing essential services to vulnerable populations, including shelter, food, and rehabilitation services. These services are specifically directed toward the homeless, individuals struggling with addiction, and other people in need. The organization operates primarily out of the state of California in the United States.

Risk assessment and organizational implications

The alleged leak of this data presents several critical risks to the organization and its stakeholders. The exposure of financial data and bank account details could potentially lead to various corporate fraud attempts. Furthermore, the sensitive nature of the leaked information poses secondary risks, such as the possibility of identity theft and the execution of targeted phishing attacks against the organization's employees and stakeholders.

Because the Rescue Mission Alliance is a US-based organization, this incident may trigger legal processes under relevant state laws and federal data protection regulations. Beyond the legal implications, the publication of such data can cause significant reputational damage and may disrupt the organization's operational processes. The threat actor appears to have adopted a double-extortion method, a tactic where attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to increase pressure on the victim.

In general, when organizations face such threats, they often focus on strengthening their defensive posture through various cybersecurity measures. This typically involves implementing robust access controls, conducting regular security awareness training for staff to prevent phishing, and maintaining rigorous backup protocols. For organizations in the non-profit and government sectors, maintaining data integrity and confidentiality is vital for maintaining public trust and ensuring the continuity of essential social services.