The Pear ransomware group listed three US healthcare businesses on its leak site on August 20, claiming it stole internal data from a Texas plastic surgery practice, a pharmacy chain, and a California Medi-Cal billing platform.
Threat trackers logged the same-day listings. Ransomware.live shows all three victims with a discovered date of August 20 and an estimated attack date of August 18, and RansomLook carried the claims within hours. GalaxyWarden rated each listing high severity while flagging them as unverified.
The victims are Austin Plastic Surgery Institute, a cosmetic surgery practice in the Texas capital; Medical Arts Chemists and Surgicals, a pharmacy and home medical equipment supplier; and Practi-Cal, a platform that handles Medi-Cal billing and enrollment submissions for California providers. None of the companies has publicly confirmed an intrusion, and no stolen files have been published.
The targets fit a pattern for the group, whose victim list includes Iroquois Memorial Hospital and Sonitor Technologies, a hospital asset-tracking vendor. Cosmetic surgery clinics, pharmacies, and billing intermediaries hold large volumes of patient identity, insurance, and payment data, which makes them attractive to extortionists even when their IT budgets are modest.
Organizations in those segments should treat the listings as a prompt to verify access controls on billing portals and third-party platforms, and to confirm that the business associates and clearinghouses they share data with have current breach response plans.
