Law Office of Ronald W. Hillberg Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional service firms that hold concentrated stores of personal and financial records, adding law practices to a long list of victims in the current threat landscape. On November 12, 2025, the Law Office of Ronald W. Hillberg was listed by the pear ransomware group, which claims internal files were taken during an attack. Public detail remains limited, yet the listing matters because the firm handles estate planning and wills, documents that often contain highly sensitive client information.

The incident underscores how even smaller legal practices can become targets when attackers seek data that can be leveraged for extortion or resale. With the number of people affected still unknown, clients and others connected to the firm face uncertainty about whether their records were among those claimed to have been removed.

What happened

According to the reported listing, the Law Office of Ronald W. Hillberg was named by the pear ransomware group on November 12, 2025. The group claims that internal files were exfiltrated in a ransomware attack. No confirmed figures have been released for the number of people affected, and public reports do not disclose the precise date of the intrusion, the initial access method, or whether systems were also encrypted. The available summary identifies the firm’s work as centered on estate planning and wills, but further operational details of the breach itself remain undisclosed.

The group behind it: pear

pear is a ransomware operation that, like many contemporary groups, has been observed using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a leak site if payment is not made. Public reporting on pear indicates the group typically posts victim names and sample claims of stolen material to pressure organizations. In this case the listing of the Law Office of Ronald W. Hillberg constitutes the group’s claim that internal files were taken; independent confirmation of the full scope of that claim has not been provided in the available facts. Prior activity attributed to pear follows the same pattern of targeting organizations that hold valuable internal records and then advertising the alleged theft.

Who is Law Office of Ronald W. Hillberg?

The Law Office of Ronald W. Hillberg is a legal practice whose reported focus is estate planning and wills. Firms of this type routinely prepare and store documents that record clients’ assets, family relationships, beneficiary designations, and personal identifying information. Because these records are both private and long-lived, a breach at such an office carries particular weight: the data can remain relevant for years and may be used to commit fraud against estates or surviving family members. The firm’s listing by a ransomware group therefore raises direct questions about the security of client files that were never intended for public exposure.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, volumes, or specific client records has been disclosed, and the number of individuals affected is unknown. Organizations that handle estate planning and wills typically maintain wills, trusts, power-of-attorney documents, asset inventories, Social Security numbers, financial account details, and correspondence containing personal identifiers. While those categories represent the kind of material commonly held by such a practice, the exact contents of the files claimed by pear remain unconfirmed. Readers should treat any assertion of specific data elements beyond “internal files” as speculative until additional verified information appears.

Why it matters

For clients, the principal risk is that sensitive estate documents could be misused for identity theft, fraudulent claims against estates, or social-engineering attacks that reference real family or financial details. Because wills and related papers often list heirs, property, and account information, exposure can create lasting complications even after the immediate incident. For the firm itself, the listing introduces reputational and operational pressures common to ransomware events: potential regulatory scrutiny, the need to notify affected parties once more is known, and the cost of investigation and remediation. The absence of confirmed numbers of people affected leaves both the organization and its clients without a clear picture of scale, which itself prolongs uncertainty and the practical burden of monitoring for misuse.

What to do if you're exposed

Anyone who has been a client of the Law Office of Ronald W. Hillberg, or who believes their information may have been among the internal files claimed by pear, should begin by placing fraud alerts or credit freezes with the major credit bureaus and by carefully reviewing financial and estate-related accounts for unusual activity. Retain copies of any notices the firm may later issue and document communications with the practice. Consider requesting free annual credit reports and monitoring for new accounts opened in your name. As an additional step, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides one more data point while official notifications remain limited. Stay alert for phishing messages that reference the firm or estate matters, and treat unsolicited requests for personal or financial details with caution until more verified information about the incident becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.