PEAR

Active
117 victims named on the leak site
11 in the last 30 days
92 in the last 12 months
Aug 2025 first victim we recorded
Sep 7, 2026 most recent victim posted
3 leak sites tracked

Data as of September 9, 2026.

Credential exposure before the attack

10.3% of PEAR victims whose domain we can identify (12 of 117) had employee credentials leak in the 12 months before PEAR named them as a victim.

We don't know whether any of these credentials were how PEAR gained initial access.

What industries PEAR targets

Sector identified for 97 of 117 victims.

Healthcare24
Legal21
Financial Services15
Manufacturing8
Construction6
Technology4
Education4
Non-profit3

Where the victims are located

Country identified for 112 of 117 victims.

United States98
Canada5
Norway2
United Kingdom1
France1
Singapore1
Australia1
Germany1

Most recent PEAR victims

VictimSectorCountryPosted
Kovo Plus kovoplus.comHealthcareCanadaSep 7, 2026
EdgeChem edgechem.comManufacturingNot identifiedSep 4, 2026
Next Level Urgent Care nextlevelurgentcare.comHealthcareUnited StatesAug 27, 2026
Island Networks islandnetjm.comTechnologyNot identifiedAug 24, 2026
Mogren, Glessner & Ahrens mgrlaw.comLegalUnited StatesAug 24, 2026
Clifton Architectural Glass & Metal cliftonglass.comNot identifiedUnited StatesAug 22, 2026
First Commerce firstcommercellc.comFinancial ServicesUnited StatesAug 22, 2026
Austin Plastic Surgery Institute austinpsi.comNot identifiedUnited StatesAug 21, 2026
Club One Casino clubonecasino.comHospitalityUnited StatesAug 21, 2026
Medical Arts Chemists and Surgicals medarts.netHealthcareUnited StatesAug 21, 2026
Practi-Cal practi-cal.comHealthcareUnited StatesAug 21, 2026
Sonitor Technologies sonitor.comHealthcareNorwayJul 31, 2026
Metropolitan Construction Systems metropolitanroof.comConstructionUnited StatesJul 27, 2026
Carient Heart & Vascular carient.comHealthcareUnited StatesJul 16, 2026
South Plains Rural Health Services sprhs.orgHealthcareUnited StatesJul 16, 2026
Faro Products faroproducts.comManufacturingCanadaJul 14, 2026
Tostrud & Temp tntcpas.comFinancial ServicesUnited StatesJul 9, 2026
AC Beverage acbeverage.comNot identifiedUnited StatesJul 6, 2026
CNW Electronics cnw.com.sgManufacturingSingaporeJul 6, 2026
ORA-ELBA Group groupe-ora.comRetailFranceJul 1, 2026

Showing the 20 most recent of 117. Browse recent data breaches for more.

PEAR leak sites

Addresses we've seen PEAR publish victims from. Any .onion address needs the Tor Browser.

  • peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
  • pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion
  • ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion

PEAR questions

Is PEAR still active?

Yes. PEAR posted its most recent victim on September 7, 2026. That's 11 victims in the last 30 days.

How many victims has PEAR claimed?

PEAR has named 117 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 92 of them were posted in the last 12 months.

When did PEAR first appear?

The first victim we recorded for PEAR was posted on August 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does PEAR target?

Healthcare accounts for the most victims we can classify, with 24. Legal follows at 21. We could identify a sector for 97 of 117 victims, so treat this as the shape of the targeting rather than a full census.

Has PEAR already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.