Garrison Law Firm Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Garrison Law Firm has been listed by the pear ransomware group, according to a report dated July 15, 2025. Public detail remains limited: the number of people affected is unknown, and the only confirmed description of the incident is that internal files were allegedly exfiltrated in a ransomware attack. For a personal-injury practice that handles sensitive client matters, even this sparse disclosure raises clear questions about what information may now be outside the firm’s control.

The listing itself is a claim by the group rather than an independently verified confirmation of every detail. What is known so far is enough to warrant careful attention from anyone who has been a client or whose personal information may have been held by the firm.

Inside the incident

On July 15, 2025, Garrison Law Firm appeared on a leak site associated with the pear ransomware group. The available public summary states that internal files were exfiltrated during a ransomware attack. No further technical details have been released about the initial intrusion method, the duration of unauthorized access, the volume of data taken, or whether systems were encrypted in addition to the theft of files. The number of individuals potentially affected remains unknown. Because the firm has not publicly expanded on the report, the precise timeline and full scope of the incident stay undisclosed.

Ransomware incidents of this type typically involve both encryption of systems and the theft of data for leverage, but only the exfiltration of internal files is explicitly named in the facts surrounding this case. No dollar figures, file counts, or specific system names have been provided in the public record.

Inside pear

Pear operates as a ransomware group that claims responsibility for attacks by listing victims on dedicated leak sites. Like many contemporary ransomware actors, the group is known to pursue a double-extortion model: encrypting systems to disrupt operations while also stealing data and threatening to publish it if a ransom is not paid. Public reporting on pear has documented its use of these standard pressure tactics across multiple claimed victims, though the group’s specific tools, initial access methods, and internal structure are not fully detailed in open sources.

In this instance, the group claims Garrison Law Firm as a victim and asserts that internal files were taken. That claim should be treated as an unverified assertion by the actors themselves until corroborated by the firm or independent investigation. No additional statements from pear about the contents of the stolen material or any ransom demands specific to this case appear in the available facts.

Garrison Law Firm and its sector

Garrison Law Firm, LLC is a personal-injury practice based in Indiana. It represents individuals who have suffered injuries from car accidents, slip-and-fall incidents, wrongful-death cases, and similar events. Firms of this kind routinely collect and store detailed personal information: medical records, accident reports, insurance correspondence, financial details related to claims, contact information, and often Social Security numbers or other identifiers needed for litigation and settlement.

A breach at a law firm carries particular weight because the data is both highly personal and legally privileged. Clients entrust the firm with information they would not share lightly, and the firm itself holds work product and case strategy that could affect ongoing legal matters. Even without confirmed client counts, the nature of personal-injury work means any internal files are likely to contain sensitive material belonging to people who are already dealing with injury or loss.

What was likely exposed

The only data type named in the public report is “internal files” exfiltrated in the ransomware attack. Exact contents have not been disclosed. Organizations that practice personal-injury law typically maintain client intake forms, medical documentation, correspondence with insurers and opposing counsel, settlement records, and administrative files containing employee or vendor information. It is reasonable to expect that some combination of these categories could be present among the internal files, yet nothing more specific has been confirmed.

Because the facts stop at “internal files,” any assertion about particular documents, medical records, or financial data would be speculation. The precise inventory remains unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include identity theft, targeted phishing that references real case details, and potential misuse of medical or financial data. Even limited personal identifiers can be combined with other breaches to create fuller profiles. Clients involved in active or recent cases may also face secondary concerns if case strategy or settlement discussions were stored in the exfiltrated material.

For the firm, the stakes include operational disruption, regulatory scrutiny under data-protection and professional-responsibility rules, and the longer-term erosion of client trust. Law firms are expected to safeguard confidential information; a ransomware incident that results in data leaving the network creates both legal exposure and reputational pressure, regardless of whether negligence is ever established.

If your data was in this claimed breach

If you have been a client of Garrison Law Firm or believe your information may have been held there, begin by monitoring financial accounts and credit reports for unusual activity. Consider placing a fraud alert or credit freeze with the major credit bureaus. Be alert for phishing messages that reference accidents, medical treatment, or legal claims—such messages may attempt to exploit knowledge of real events. Change passwords on any accounts that reused credentials shared with the firm, and enable multi-factor authentication wherever possible.

You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. That step provides an immediate, concrete way to assess whether your details have surfaced publicly and helps prioritize further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.