Cullen, Haskins, Nicholson & Menchetti Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have dealt with Cullen, Haskins, Nicholson & Menchetti may now face uncertainty about whether their personal information has been taken. The firm, which represents injured workers in Illinois state compensation cases, has been listed by the pear ransomware group as a victim of a ransomware attack involving the exfiltration of internal files. Public detail on the number of people affected remains unknown, and the exact nature of what was taken is limited to the description of internal files. For clients and others whose records the firm may hold, this raises practical questions about privacy and potential misuse of sensitive details tied to workplace injuries and claims.

The listing was reported on August 27, 2025. While the group claims the firm as a victim, independent confirmation of the full scope is not provided in available records. What is known centers on the ransomware nature of the incident and the reported removal of internal files, leaving those connected to the firm to weigh the possible exposure of information that law practices of this type routinely manage.

Inside the incident

According to the available facts, Cullen, Haskins, Nicholson & Menchetti was listed by the pear ransomware group. The reported summary states that internal files were exfiltrated in a ransomware attack. The date associated with the public reporting of this listing is August 27, 2025. No further public detail is given on the precise timing of the intrusion itself, the method of initial access, the volume of data involved, or any ransom demands. The number of people affected is listed as unknown. The facts describe the event as a ransomware attack in which internal files were taken, but they do not expand on technical indicators, duration of access, or subsequent actions by the firm. All specifics beyond the listing and the exfiltration claim remain undisclosed in the provided record.

Who is pear?

Pear is a ransomware group known in public cybersecurity reporting for conducting double-extortion operations. In such campaigns, the group typically encrypts systems while also claiming to steal data, then pressures victims by threatening to publish the material on a dedicated leak site if payment is not made. Public accounts of the group describe it as one that lists organizations it claims to have compromised, often providing limited samples or descriptions of stolen files to support those claims. Notable prior activity attributed to pear in open sources includes targeting various sectors and posting victim names along with assertions of data theft. In this case, the group claims Cullen, Haskins, Nicholson & Menchetti as a victim through its listing; the facts do not confirm independent verification of that claim or any specific statements pear made about the contents of the files beyond the general report of internal files exfiltrated. As with other ransomware actors of this type, listings function as pressure tactics and should be treated as unverified assertions unless corroborated.

About Cullen, Haskins, Nicholson & Menchetti

Cullen, Haskins, Nicholson & Menchetti is a law firm that represents injured workers in Illinois state compensation cases. Firms of this kind operate in the workers’ compensation and personal-injury legal sector, assisting clients with claims arising from workplace injuries. Such organizations typically maintain case files that can include personal identifiers, medical records related to injuries, employment details, correspondence with insurers and employers, and financial information connected to settlements or benefits. A breach involving a practice that handles these matters is consequential because the data often relates to individuals in vulnerable positions—people dealing with physical harm, lost wages, and ongoing medical needs. Exposure of that material can affect privacy, claim integrity, and personal security for those clients, even when the precise scale of any incident remains unknown.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No more granular list of data types—such as specific categories of personal, medical, or financial records—is provided. The exact contents therefore remain unconfirmed. Organizations that represent injured workers in state compensation cases typically hold sensitive client information, including names, contact details, Social Security numbers or other identifiers, medical documentation of injuries, employment histories, and records of legal proceedings or settlements. Because the public record here states only that internal files were taken, it is not possible to confirm which of those typical categories, if any, were among the exfiltrated material. Readers should treat any assumption about particular data elements as speculative until further verified detail emerges.

What's at stake

For individuals whose information may have been held by the firm, the practical risks include potential identity theft, fraudulent claims activity, or targeted scams that leverage knowledge of a workplace injury or compensation case. Medical and employment details, if present, could be used to craft convincing social-engineering attempts or to sell data on underground markets. Even without confirmed numbers of affected people, the nature of workers’ compensation practice means that any exposed files could touch on health status and financial vulnerability. For the firm itself, the incident carries operational, reputational, and regulatory consequences common to legal practices handling protected client data, including possible notification obligations and the need to assess residual system integrity. None of these outcomes is asserted as having already occurred; they represent the concrete stakes that follow from a ransomware listing of this type when internal files are reported as taken.

What to do if you're exposed

If you have been a client of Cullen, Haskins, Nicholson & Menchetti or believe your information may have been among the firm’s internal files, begin by monitoring financial accounts and credit reports for unusual activity. Consider placing a fraud alert or credit freeze with the major credit bureaus, and be cautious of unsolicited contacts that reference a workplace injury or legal claim. Preserve any correspondence you have received from the firm about the incident. Because the number of people affected and the precise data types remain unknown, treat the situation as a precautionary matter rather than confirmed personal compromise. As an additional step, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets elsewhere. Stay alert for official notices from the firm or relevant authorities, and avoid sharing further personal details in response to unexpected requests until you can verify their legitimacy.

AICompiled with AI assistance from public sources and published under our editorial standards.