Atlantic National Trust Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Atlantic National Trust was listed by the pear ransomware group on January 26, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check the company’s site or contact them to see if your data is involved.
On January 26, 2026, the ransomware group pear listed Atlantic National Trust on its leak site, stating that internal files had been taken during a ransomware attack. The number of individuals whose information may be involved remains unknown, and no further details on the volume or specific contents of the data have been made public. For customers, borrowers, and business partners of a firm that handles commercial lending and real estate transactions, the listing raises the possibility that sensitive operational records have left the organization’s control.
Breaking down the breach
The only confirmed information is the group’s public listing and the statement that internal files were allegedly exfiltrated. No date of the intrusion, no description of the initial access method, and no count of affected records have been disclosed. The organization has not issued a separate statement confirming or disputing the claim.
Who is pear?
Pear is a ransomware operation that follows the common pattern of encrypting systems, copying data, and then posting victim names on a dedicated leak site when ransom demands are not met. Such groups typically seek payment in cryptocurrency and use the threat of data publication as leverage. The listing of Atlantic National Trust constitutes the group’s claim; independent verification of the data’s authenticity or scope has not been reported.
Who is Atlantic National Trust?
Atlantic National Trust operates in commercial asset-backed lending, real-estate acquisition, secured lending, development, and property management. Organizations in this sector routinely collect and store financial statements, loan documentation, property records, and contact information for borrowers and counterparties. A compromise at such a firm can therefore touch detailed commercial and personal financial information that is not ordinarily public.
What was likely exposed
The listing refers only to “internal files.” The precise categories of data have not been published. Firms of this type commonly retain loan applications, credit analyses, collateral records, and correspondence; however, whether any of these specific document types were taken remains unconfirmed.
The real-world impact
Exfiltrated internal files could contain details that enable targeted fraud, identity misuse, or competitive intelligence gathering. Borrowers and business partners may face increased risk of phishing or account takeover attempts if their contact or account information appears in the material. The organization itself may incur costs related to investigation, notification, and potential regulatory scrutiny, though the extent of these obligations depends on facts that have not yet been released.
Were you affected?
Individuals who have borrowed from, partnered with, or provided information to Atlantic National Trust should monitor their financial accounts and credit reports for unusual activity. Changing passwords for any associated online services and enabling multi-factor authentication are standard first steps. Readers may also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Optimum First Mortgage Listed by pear Ransomware GroupWyatt Insurance Agency Listed by pear Ransomware GroupJ.R. Martin & Associates Listed by pear Ransomware GroupAC Beverage, Inc. Listed by pear Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Atlantic National Trust Listed by pear Ransomware Group →
Publicly posted by pear — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.