Skip to content
Ransomware

U.S. Battery listed on pear ransomware leak site following claims of a data breach

U.S. Battery has been listed on the leak site of the ransomware group known as pear, following claims of a data breach.

By
Siberpol Intelligence Unit
Published
2 min read
2 min read
  • Ransomware group: pear
  • Country: United States
  • Sector: Manufacturing
  • Announcement date: August 5, 2025

The ransomware group known as pear has listed U.S. Battery on its leak site, claiming to have successfully executed a data breach against the organization. According to the announcement made on August 5, 2025, the threat actors allege they gained unauthorized access to the company's internal systems, resulting in the acquisition of a significant volume of sensitive information.

Details of the alleged attack

The claims made by the pear group suggest that the breach occurred around July 21, 2025. The threat actors assert that they managed to exfiltrate approximately 1 TB of data from the organization. To support their claims of a successful intrusion, the group has provided various images on their leak site that purportedly depict the organization's internal production processes and technical documentation.

In modern cyberattack landscapes, such incidents often follow a pattern known as double extortion. In this scenario, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or private information. This tactic increases the pressure on organizations, as the loss of data can lead to long-term reputational and legal consequences even if systems are restored from backups.

Reported stolen data

While the exact contents of the breach remain the claims of the threat actor, the listing specifies that a wide range of sensitive materials has been targeted. The information allegedly leaked includes various types of critical corporate and personal documentation. According to the group, the following data types are involved in the leak:

  • Financial documents
  • HR records
  • Production plans
  • Technical drawings
  • Internal correspondence

The exposure of such diverse datasets suggests a deep level of access into the organization's digital environment, spanning from administrative and human resources departments to core manufacturing and engineering functions.

About U.S. Battery

U.S. Battery is an American company that has been operating since 1926. The organization specializes in the design and manufacturing of deep-cycle batteries. They are a provider of high-quality energy storage solutions intended for various industrial and commercial applications.

Potential impact and organizational risks

This incident may present a significant risk of exposing the organization's sensitive commercial and operational data. Given the specific nature of the alleged data, such as technical drawings and production plans, there may be negative impacts on the organization's intellectual property and its overall competitive advantage in the manufacturing sector.

Furthermore, as a United States-based organization, a potential data breach of this magnitude could trigger specific notification obligations under relevant state laws and federal regulations. Beyond the corporate impact, the leaked HR data may lead to risks such as identity theft and the execution of targeted phishing attacks against the organization's employees.

In the manufacturing sector, protecting intellectual property is vital for maintaining market position. Organizations in this industry often implement defensive steps such as network segmentation, strict access controls, and continuous monitoring to mitigate these risks. However, as seen in this case, the motivations and specific operational methods of groups like pear remain limited in public knowledge, making it difficult to perform a definitive assessment of their specific tactics.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories