Riddell Law Group listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: October 28, 2025

The ransomware group known as pear has listed the United States-based law firm Riddell Law Group on its leak site. The group claims to have successfully exfiltrated data from the organization, marking a potential significant breach for the professional services firm. This announcement, posted on October 28, 2025, follows an alleged attack date of October 15, 2025. While the group has made these claims, information regarding the specific identity and operational details of the pear group remains limited.

The claimed attack and event details

According to the announcement made by the pear group, the organization has been targeted in a cyberattack. The group's listing on their dedicated leak site serves as a public claim that they have gained unauthorized access to the firm's internal systems and successfully extracted sensitive information. In modern ransomware operations, threat actors often employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive files to use as leverage. By threatening to release this data publicly on a leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

The announcement details the firm's specific areas of operation and outlines the categories of data that have allegedly been compromised during the breach. However, the group has not provided specific details regarding the total volume of data stolen or the total count of files involved. Additionally, no ransom demand has been publicly specified in the announcement. The listing serves as a notification of the alleged breach, highlighting the categories of information the group claims to possess.

Alleged compromised data categories

The claims made by the pear group suggest that a wide variety of sensitive documents and records have been compromised. The information allegedly exfiltrated includes highly sensitive materials that are central to the legal profession and corporate operations. The specific categories of data mentioned in the announcement include:

• Privileged client information
• Title records
• Court documents
• Corporate correspondence

The presence of such data types in a leak site announcement suggests that the attackers may have targeted specific repositories containing legal and administrative files. The compromise of such information can have cascading effects on the privacy of clients and the operational integrity of the firm.

About Riddell Law Group

Riddell Law Group is a professional services firm based in the United States. The organization specializes in a diverse range of legal matters, including real estate law, title insurance, probate estate planning, bankruptcy, and foreclosure proceedings. Given the nature of these legal specialties, the firm handles sensitive financial, property, and personal documentation for its clients.

Risks and implications of the alleged breach

This alleged data breach may pose significant risks to the law firm regarding client confidentiality and attorney-client privilege. Because the organization is based in the United States, the incident may trigger legal proceedings under various state-level data protection laws and professional conduct rules governing legal practitioners. The exposure of privileged communications and court documents can undermine the fundamental trust required in the attorney-client relationship.

Furthermore, there is a high probability that the allegedly compromised documents could be utilized by malicious actors for identity theft or highly targeted phishing campaigns. When sensitive client information and corporate correspondence are leaked, attackers can craft convincing messages to deceive individuals or other organizations.

To defend against such threats, organizations in the professional services sector typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict access controls can help mitigate the impact of both data exfiltration and encryption-based ransomware attacks.