Skip to content
Ransomware

Roger D. Mason II, P.A. listed on pear ransomware leak site

Florida-based law firm Roger D. Mason II, P.A. has been listed on the leak site of the ransomware group known as pear.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: pear
  • Country: United States
  • Sector: Professional Services
  • Announcement date: May 1, 2026

Ransomware group pear claims data breach against Roger D. Mason II, P.A.

The ransomware group known as pear has listed the Florida-based law firm Roger D. Mason II, P.A. on its leak site. According to the announcement made on May 1, 2026, the group claims to have compromised various documents related to the firm's operations. The breach is alleged to have occurred around April 16, 2026.

This type of incident is characteristic of double extortion tactics often employed by modern ransomware groups. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat actors then use the threat of leaking this stolen information on public leak sites to pressure the victim into paying a ransom. By releasing a portion of the alleged data publicly, the group aims to increase the psychological and reputational pressure on the target organization.

Details of the claimed data theft

The announcement suggests that the group has gained access to a variety of sensitive documents belonging to the firm. Based on the information provided by the group, the leaked content includes highly sensitive personal and financial information. The data identified in the screenshots provided by the attackers includes:

  • Social security numbers
  • Bank account details
  • Credit card information
  • Personally identifiable information
  • Legal correspondence

The presence of such sensitive information highlights the high stakes involved in these types of cyberattacks. When financial details and government identifiers are compromised, the risk to the individuals whose data was stolen increases significantly. No specific information was provided regarding the total size of the data stolen or the total number of files involved in the incident.

About Roger D. Mason II, P.A.

Roger D. Mason II, P.A. is a professional services firm operating within the legal sector. The law firm is based in Florida and provides specialized legal consulting services. The firm's primary areas of expertise include consumer rights and legal matters specifically related to auto dealership fraud.

Implications and industry risks

This incident demonstrates that law firms are frequently targeted by cybercriminals due to the sensitive nature of the client data they manage. The breach of such information can lead to severe consequences for both the firm and its clients. For the individuals affected, the exposure of social security numbers and financial details creates a high risk of identity theft and various forms of fraud.

Because the firm operates within the United States, this incident may trigger complex legal obligations. These include state-level data breach notification laws and specific regulations regarding attorney-client privilege. Beyond the legal ramifications, the breach can damage the fundamental trust relationship between a law firm and its clients. Furthermore, organizations that suffer such breaches may find themselves becoming targets for secondary attacks as their vulnerabilities are exposed.

While public information regarding the specific methods and identity of the pear group remains limited, this event serves as a reminder of the ongoing threats facing the professional services sector. Organizations in this sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit to mitigate these risks. However, the evolving nature of ransomware continues to pose a significant challenge to data privacy and organizational security.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories