Twin Oaks Presbyterian Church listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Government & Defense
• Announcement date: August 5, 2025

The pear ransomware group claims a breach at Twin Oaks Presbyterian Church

The threat group known as pear has listed Twin Oaks Presbyterian Church on its leak site, claiming to have exfiltrated data from the organization. This announcement, which appeared on the group's platform on August 5, 2025, suggests a targeted operation aimed at the religious institution. While the group has posted proof of the breach, the incident highlights the ongoing risks faced by non-profit and religious organizations in the current cyber threat landscape.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption occurs. The attackers then threaten to leak this stolen data on public forums or specialized leak sites if their demands are not met. This method places immense pressure on organizations, as the exposure of private data can lead to significant reputational damage and legal consequences, regardless of whether the organization restores its systems from backups.

Details of the claimed attack

According to the claims made by the pear group, the breach occurred around July 3, 2025. To support their claim that they successfully breached the organization's network, the group shared various documents as alleged proof. These samples, provided via screenshots, appear to belong to the organization, though some administrative forms in the samples appear to belong to City Museum.

The information shared by the group indicates that the breach involves several types of internal documentation. The specific data types identified in the leak include:

• Meeting minutes
• Volunteer lists
• Administrative forms

The presence of such documents suggests that the attackers may have gained access to internal administrative processes and personnel-related information. While the specific volume of data and the exact nature of the exfiltration remain unconfirmed, the availability of these documents on a leak site is a hallmark of modern ransomware extortion campaigns.

About Twin Oaks Presbyterian Church

Twin Oaks Presbyterian Church is a Presbyterian church located in Ballwin, Missouri. As a religious organization, its primary focus is on worship, discipleship, and community outreach. Such organizations often handle sensitive information regarding their members, volunteers, and community participants, making them potential targets for cybercriminals seeking personal data or looking to exploit the trust inherent in religious institutions.

Risk assessment and organizational implications

This incident may pose a risk of exposing sensitive information regarding the organization's internal operations. The personal data contained within the shared documents could potentially be exploited by third parties for identity theft or targeted phishing attacks. For organizations in the religious and non-profit sectors, the loss of member or volunteer information can undermine the trust of the community they serve.

Given the organization's location in the United States, notification obligations may arise under relevant state laws and data protection regulations. When a breach involving personal information is suspected, organizations must navigate complex legal frameworks that dictate how and when affected individuals must be notified. Furthermore, the group responsible for this listing, pear, currently has limited public information available regarding its specific tactics, techniques, and procedures.

To mitigate the impact of such incidents, organizations are generally advised to conduct a comprehensive digital forensic investigation to determine the full scope of the leaked data and identify the initial entry point used by the attackers. Standard defensive measures include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff and volunteers to prevent successful phishing attempts. As the investigation into this specific claim continues, the focus remains on understanding the extent of the exposure and securing the organization's digital perimeter.