Angstrom Automotive Group Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Angstrom Automotive Group was listed by the pear ransomware group on December 01, 2025, after internal files were exfiltrated in a ransomware attack. Individuals should check whether their information was exposed and take appropriate protective steps.
What happened
On December 01, 2025, the pear ransomware group listed Angstrom Automotive Group on its leak site. The entry states that internal files were exfiltrated during a ransomware attack. No further details on the date of the intrusion, the volume of data taken, or the method of initial access have been made public. The organization has not issued a statement confirming or disputing the listing.
Who is pear?
Pear is a ransomware operation that maintains a public leak site where it posts the names of organizations it claims to have compromised. Like other groups of this type, it typically pairs file encryption with the threat of data publication to pressure victims. Public reporting on the group’s prior activity shows it has targeted organizations across multiple sectors and has used similar leak-site listings to draw attention to its claims. In this case, the group’s assertion that it holds material from Angstrom Automotive Group stands as an unverified claim until independently confirmed.
Who is Angstrom Automotive Group?
Angstrom Automotive Group operates as a tier 1 full-service supplier to automotive and industrial original equipment manufacturers. Companies in this position routinely manage production schedules, component specifications, quality records, and contractual information shared with vehicle makers and other suppliers. Because these firms sit at the center of complex supply chains, any disruption or exposure of their systems can affect downstream manufacturing and the data of partner organizations as well as their own workforce.
The information in question
The listing describes the material as internal files exfiltrated in a ransomware attack. No inventory of specific file types or data categories has been released. Organizations of this kind commonly store employee records, supplier contracts, engineering documents, and communications with OEM customers. The precise contents of the exfiltrated files remain unconfirmed.
What's at stake
For individuals, the main concern is the potential misuse of any personal identifiers, employment details, or contact information that may have been included in the files. For the organization and its partners, the exposure of internal documents could reveal operational practices or commercial relationships that are normally kept confidential. The absence of a confirmed count of affected records makes it difficult to assess the full scope of these risks at present.
If your data was in this claimed breach
Individuals who have worked with or for Angstrom Automotive Group, or who have done business through its supply chain, can begin by monitoring their email accounts and credit reports for unusual activity. Running a free exposure scan of an email address against known breach data provides one way to check whether the address has appeared in previously published sets. Organizations should follow standard incident-response practices, including reviewing access logs and considering whether additional authentication measures are warranted for systems that interact with suppliers.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
US Graphite Listed by pear Ransomware GroupU.S. Battery Listed by pear Ransomware GroupBromack Manufacturing Listed by pear Ransomware GroupOffice Furniture Group Listed by pear Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Angstrom Automotive Group Listed by pear Ransomware Group →
Publicly posted by pear — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.