Westside GI targeted by pear ransomware group in alleged data breach

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: September 24, 2026

The pear ransomware group claims a breach at Westside GI

The threat actor known as pear has announced the alleged data leak of Westside GI on their leak site. According to a post dated September 24, 2026, the group claims to have targeted the organization, asserting that they successfully gained access to the systems of the medical center on September 22, 2026. The announcement indicates that the organization's data has been compromised and may be published by the attackers.

Information regarding the specific identity and operational details of the pear group remains limited in the public domain. This lack of public information is common with emerging or niche ransomware groups that operate with a degree of anonymity, making it difficult for security researchers to attribute specific campaigns or predict future movements based on historical patterns.

Details of the alleged data theft

The post shared by the threat actor provides specific details regarding the volume and nature of the information they claim to have exfiltrated. The total size of the alleged leaked data is stated to be 10 GB. While the specific file count was not provided in the announcement, the group has categorized the types of information they claim to possess.

The data allegedly stolen includes several sensitive categories of information that are highly valued by cybercriminals for extortion purposes. The types of data mentioned in the claim include:

• Financial documents
• Patient records
• Employee data

In the context of modern cyberattacks, this type of data theft often points toward a strategy known as double extortion. In a double extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. The threat of leaking private information to the public or to regulators is used to pressure the victim into paying a ransom. This method significantly increases the pressure on an organization, as the consequences of a leak can be more damaging than the operational downtime caused by encryption.

About Westside GI

Westside GI is an ambulatory endoscopy center located in California, United States. The organization provides specialized medical services focused on the diagnosis and treatment of digestive system diseases. Given its role in providing specialized medical care, the organization handles a significant amount of sensitive information regarding patient health and medical history.

Implications and sectoral risks

The nature of the alleged leaked data may increase the risk of identity theft or targeted phishing attacks against the organization's patients and employees. When sensitive personal and financial information is compromised, individuals become targets for sophisticated social engineering attempts designed to exploit the stolen details. For a healthcare provider, the stakes are particularly high due to the sensitive nature of medical records.

Because the organization operates in the healthcare sector, this situation may trigger legal processes under HIPAA regulations. Regulatory frameworks such as HIPAA are designed to ensure the privacy and security of sensitive patient health information, and breaches of this nature often necessitate formal investigations and mandatory reporting requirements. Furthermore, the publication of such data could create negative impacts on the organization's operational credibility and patient trust.

To mitigate such risks, organizations in the healthcare sector often find it necessary to review their data security protocols and notify the affected parties. Common defensive steps for organizations include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized access. Additionally, regular security audits and employee training programs are essential components of a comprehensive cybersecurity posture designed to defend against the evolving tactics of ransomware groups.