Siegel Lewitter Malkani listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: April 9, 2026

Siegel Lewitter Malkani targeted by pear ransomware group

The San Francisco-based law firm Siegel Lewitter Malkani has been listed on the leak site of the ransomware group known as pear. According to an announcement posted on April 9, 2026, the group claims to have successfully targeted the organization, alleging that they have obtained a significant amount of sensitive data belonging to the firm.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen information. This tactic is often part of a "double extortion" strategy, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. By publishing a victim's name on a public leak site, the group aims to maximize reputational damage and increase the pressure on the target to comply with their demands.

Claims of a massive data breach

The pear group has officially listed Siegel Lewitter Malkani on its leak site, asserting that they have compromised a substantial volume of information. The group claims that the breach occurred around April 6, 2026. According to the announcement, the total size of the allegedly stolen data is approximately 25 GB.

The group asserts that the compromised information is not limited to a single category but encompasses a wide range of data essential to the law firm's operations. Specifically, the group claims that the stolen data includes both operational information and sensitive client-related data, highlighting the potential impact on the firm's professional activities and its relationship with those it represents.

Details of the allegedly stolen information

The announcement provides a detailed list of the types of information that the pear group claims to have exfiltrated from the firm's systems. While the exact number of files has not been disclosed, the group specifies that the 25 GB of data consists of several critical categories of information. According to the claim, the compromised data includes:

• Operational data
• Client information
• Confidential documents
• Case files
• Employee records
• Financial documents

The presence of such diverse data types—ranging from internal financial records to sensitive case files—indicates that the attackers claim to have gained access to multiple layers of the organization's digital environment. This type of access is a primary goal for ransomware actors looking to maximize their leverage during negotiations.

Implications and organizational risks

This incident may lead to significant privacy breaches and reputational damage for the clients of the law firm. Because law firms are tasked with handling highly sensitive and privileged information, the leaked data could potentially be used for identity theft or highly targeted phishing attacks against the firm's clients or employees. Such attacks often exploit the trust established between a legal professional and their client.

As the institution is based in the United States, the alleged breach may trigger various legal obligations under state laws and relevant data protection regulations. Organizations in the professional services sector, particularly law firms, must navigate complex regulatory landscapes when sensitive client information is compromised. Furthermore, information regarding the pear group remains limited, and their specific methods and motivations remain uncertain.

To defend against such threats, organizations typically implement a multi-layered security approach. This includes maintaining robust backup solutions, implementing multi-factor authentication across all systems, and conducting regular employee training to recognize phishing attempts. Continuous monitoring of network traffic and strict access controls are also standard defensive measures used to mitigate the risk of unauthorized data exfiltration. At this time, no information has been provided regarding the group's specific ransom demands or the firm's response to the claim.