Skibiel Law listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Professional Services
• Announcement date: February 28, 2026

Skibiel Law targeted by pear ransomware group

The threat actor known as pear has listed the US-based law firm Skibiel Law on its ransomware leak site. According to the announcement made on February 28, 2026, the group claims to have compromised a significant amount of data belonging to the organization. While the listing is a claim made by the threat actor, it indicates a potential major security incident involving a professional services firm.

Details of the alleged data breach

The announcement by the pear ransomware group asserts that the attack occurred around February 18, 2026. The group claims that the volume of data stolen during this incident amounts to 1.2 TB. Information regarding the specific identity and background of the pear group remains limited in the public domain, making it difficult to establish a broader pattern of activity for this specific actor.

The content of the alleged breach is described as containing highly sensitive information. According to the claims made by the threat actor, the stolen data includes the following types of files:

• Confidential client data
• Court documents
• Medical reports
• Insurance documents
• Correspondence

The nature of these files suggests that the breach could involve a wide array of sensitive personal and legal information essential to the firm's operations and its clients' private lives.

About Skibiel Law

Skibiel Law is a law firm based in the state of Georgia, United States. The firm specializes in providing legal services focused on work-related injuries and personal injury cases. Given their specialization, the firm handles a high volume of sensitive documentation related to medical history and legal proceedings.

Risks and implications of the incident

This alleged data breach may pose a significant risk of exposure for sensitive personal and medical information belonging to the firm's clients. Because the institution operates within the United States, this incident could lead to legal consequences under both state laws and federal regulations. The exposure of such data often places clients at a higher risk of being subjected to identity theft or targeted phishing attacks.

Beyond the immediate data exposure, secondary risks may emerge, such as the erosion of the firm's professional reputation and a decline in client trust. The threat actor's intent to publish the data may be aimed at pressuring the institution through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release unless a ransom is paid.

In such scenarios, organizations typically face the challenge of managing both operational recovery and significant regulatory and reputational fallout. While the specific ransom demand for this incident has not been disclosed, the presence of the firm on a leak site highlights the ongoing threat that ransomware groups pose to professional service providers who manage high-value, sensitive client information.