Colorado Pulmonary Intensivists Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 13, 2026, the ransomware group pear listed Colorado Pulmonary Intensivists on its leak site and stated that internal files had been taken during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the material have been released publicly. This development occurs against a backdrop of sustained ransomware activity targeting healthcare providers, where data exfiltration followed by public claims has become a recurring pattern. The incident underscores the exposure risks faced by smaller specialist practices that hold sensitive patient information.

Breaking down the breach

The only confirmed information is the April 13, 2026 listing by pear and the assertion that internal files were removed. No timeline for the intrusion itself, no count of records, and no description of the attack method have been disclosed. The organization has not issued a public statement confirming or disputing the claim.

Inside pear

Pear is a ransomware operation that, like several other documented groups, maintains a leak site where it lists organizations it claims to have compromised. These actors commonly encrypt systems to disrupt operations and copy data for potential later release or sale. Public reporting on the group has noted repeated use of this dual tactic across multiple sectors, though specific claims about any single victim remain unverified until independently confirmed.

Colorado Pulmonary Intensivists and its sector

Colorado Pulmonary Intensivists provides outpatient pulmonary care, sleep medicine, and critical-care services. Organizations of this type routinely process clinical notes, diagnostic results, insurance details, and appointment records. In the healthcare sector, even limited unauthorized access to such systems can intersect with regulatory obligations around patient information and continuity of care.

What was likely exposed

The listing refers only to “internal files.” The precise categories of data involved have not been disclosed. Practices in this field typically maintain electronic health records, billing information, and administrative documents; however, whether any of these specific materials were among the files referenced remains unconfirmed.

What's at stake

For individuals whose records may be involved, potential consequences include unauthorized use of personal or medical details and possible follow-on contact from unknown parties. For the organization, the incident adds to the operational and compliance workload already associated with ransomware events in healthcare, regardless of whether further data publication occurs.

Were you affected?

Individuals can begin by contacting Colorado Pulmonary Intensivists directly for any official notifications. Running a free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published collections, though such scans will not yet reflect this specific incident. Monitoring financial and medical accounts for unusual activity remains a standard precaution while more details are awaited.

AICompiled with AI assistance from public sources and published under our editorial standards.