Exchange Group Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Exchange Group was listed by the pear ransomware group on May 20, 2026, after internal files were exfiltrated in a ransomware attack. Individuals are advised to check whether their data may have been affected and take appropriate protective steps.
Breaking down the breach
The breach surfaced solely through the group's public listing rather than any statement from Exchange Group itself. The listing asserts that files were removed from the organization's systems, yet the date of the intrusion, the entry point used, and the volume of material taken are not described. Public reporting provides no independent confirmation of these details or of any ransom demand and response.
Inside pear
Pear is a ransomware operator that publishes victim names on a dedicated leak site when its demands are not met. Groups of this kind commonly combine file encryption with data removal to increase pressure on targeted organizations. Public records document similar listings by the group against entities in multiple industries, though the accuracy of any individual claim requires separate verification.
Exchange Group and its sector
Exchange Group supplies accounting and consulting services to clients in Manitoba. Organizations in this sector routinely process financial statements, tax filings, payroll records, and other business documentation. Because such firms serve as custodians of both corporate and personal financial information, any confirmed exfiltration can extend consequences beyond the immediate victim to its clients and counterparties.
The information in question
The listing refers only to "internal files" that were removed. No further breakdown of file contents or data categories has been supplied. While accounting and consulting firms typically maintain client identifiers, banking details, and regulatory submissions, the exact composition of the material claimed in this case remains unconfirmed.
What's at stake
Any personal or financial records present in the exfiltrated files could be used for account takeovers, tax-related fraud, or other forms of misuse. The organization may encounter regulatory inquiries and added costs for investigation and remediation. The concrete impact on individuals cannot be assessed until the scope and contents of the files are clarified by the firm or through further disclosures.
If your data was in this claimed breach
Anyone who suspects their information may be involved should review bank and credit-card statements for unrecognized transactions and contact their financial institutions if discrepancies appear. Placing a fraud alert with major credit bureaus provides an additional layer of monitoring. Readers can also run a free exposure scan of their email address against known breach datasets to determine whether their details have appeared in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Optimum First Mortgage Listed by pear Ransomware GroupKinsmen TeleMiracle Listed by pear Ransomware GroupWyatt Insurance Agency Listed by pear Ransomware GroupJ.R. Martin & Associates Listed by pear Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Exchange Group Listed by pear Ransomware Group →
Publicly posted by pear — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.