San Diego Eye Bank listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: February 8, 2026

San Diego Eye Bank targeted by pear ransomware group

The San Diego Eye Bank has been listed on a leak site belonging to the threat group known as pear. The group has published an announcement alleging that the organization has suffered a significant data breach. This announcement was made public on February 8, 2026, though the group claims the actual security incident occurred on February 4, 2026. At this time, information regarding the specific identity and background of the pear group remains limited.

Details of the alleged security incident

The claims made by the pear group suggest that the San Diego Eye Bank experienced a security event that resulted in the compromise of sensitive information. According to the announcement, the breach involves a variety of internal and sensitive documentation. While the group has published a listing, they have not provided specific details regarding the total volume of data stolen or the exact number of files involved. Furthermore, there has been no mention of a specific ransom demand or a confirmed amount required to prevent the release of the data.

The group's claims regarding the types of information compromised are quite broad. Based on the announcement and accompanying screenshots, the following categories of data are alleged to have been stolen:

• Financial data
• Patient records
• Employee information
• Administrative documents

About San Diego Eye Bank

San Diego Eye Bank is a non-profit healthcare organization based in the United States. It operates specifically within the state of California. The organization specializes in the procurement and distribution of eye tissue, which is essential for corneal transplants and various other ocular treatments. Because of its role in the healthcare sector, the organization manages highly sensitive information related to medical procedures and patient care.

Potential risks and industry implications

The allegations made by the pear group pose significant risks to patient privacy, particularly given the specialized nature of the institution's operations in the healthcare sector. Because the organization operates within the United States, this incident may trigger specific legal processes and mandatory notification requirements under HIPAA regulations. Such regulations are designed to ensure that patient data is protected and that individuals are informed when their sensitive information is compromised.

The nature of the data allegedly targeted—including patient details and employee information—increases the potential for secondary risks. These risks include identity theft and the possibility of targeted phishing attacks directed at both the employees of the institution and the patients it serves. In many modern ransomware attacks, threat actors employ a double-extortion strategy. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the data publicly, attackers create significant pressure on the victim to pay a ransom to avoid reputational damage and legal consequences.

For organizations operating in the healthcare sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing strict access controls, maintaining comprehensive audit logs, and ensuring regular, encrypted backups are stored offline. Protecting the operational continuity of a healthcare entity is vital, as disruptions can impact the delivery of essential medical services. The potential for negative impacts on an institution's reputation and its ability to function is a primary driver for the tactics used by groups like pear.