Medical Center, LLP Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers as part of a broader pattern of double-extortion attacks that combine system disruption with data theft. In this landscape, smaller medical practices face the same pressures as larger institutions because the data they hold retains high value for criminals. On October 17, 2025, the ransomware group known as pear listed Medical Center, LLP on its leak site, claiming the organization as a victim of an attack involving the exfiltration of internal files.

Public detail remains limited, yet the listing itself places the practice and anyone whose information it may hold under heightened scrutiny. For patients and staff of a family medicine and primary care clinic, the incident raises concrete questions about what information left the network and how that exposure could affect daily life.

What happened

According to available reporting, Medical Center, LLP was listed by the pear ransomware group on October 17, 2025. The group claims that internal files were exfiltrated during a ransomware attack. The number of people affected is unknown, and further specifics—such as the precise date the intrusion began, the method of initial access, the volume of data taken, or whether systems were encrypted—have not been publicly disclosed. The listing itself constitutes the primary public claim; independent confirmation of the full scope has not been provided in the available facts.

No additional technical indicators, ransom demands, or timelines beyond the listing date appear in the record. As with many such incidents, the public picture rests on the threat actor’s assertion that data left the organization.

The group behind it: pear

Pear is a ransomware operation that follows the now-common double-extortion model: operators gain access to a network, steal data, and then threaten to publish it unless a payment is made. The group maintains a leak site where it posts victim names and, in some cases, sample files to pressure organizations. Public reporting on pear shows a pattern of targeting mid-sized entities across multiple sectors, including healthcare, where the sensitivity of records can increase leverage.

In this instance the group claims Medical Center, LLP as a victim and asserts that internal files were exfiltrated. No further statements attributed specifically to pear about this organization—such as claims of particular file categories, patient counts, or ransom amounts—appear in the available facts. The listing should therefore be treated as an unverified claim pending any confirmation from the organization or independent investigators.

About Medical Center, LLP

Medical Center, LLP is described as a family medicine and primary care practice located in Dublin, Georgia. Organizations of this type deliver routine and preventive care, manage chronic conditions, and maintain ongoing relationships with patients in their communities. As a limited liability partnership operating in the medical sector, it handles the administrative and clinical records necessary to provide those services.

A breach involving a primary-care practice is consequential because such clinics routinely process protected health information, insurance details, and personal identifiers. Even when the exact contents of any stolen files remain unconfirmed, the mere possibility that clinical or administrative data left the network creates lasting concern for patients who rely on the practice for continuity of care.

What data was at risk

The available facts state only that internal files were exfiltrated in a ransomware attack. No specific data types—such as patient names, medical records, Social Security numbers, billing information, or employee files—have been named beyond that general description. The exact contents therefore remain unconfirmed.

Organizations of this kind typically hold electronic health records, appointment histories, insurance and billing data, contact information, and internal administrative documents. Whether any of those categories were among the files claimed by pear is not established in the public record. Readers should treat the exposure of particular data elements as possible rather than proven until further details emerge.

What's at stake

For individuals whose information may have been involved, the primary risks include identity theft, medical identity fraud, and unwanted contact from criminals who obtain personal details. Medical identity fraud can lead to incorrect entries in health records, denied insurance claims, or difficulties obtaining care. Even limited internal files can contain enough identifiers to enable phishing or social-engineering attempts that appear legitimate because they reference real medical relationships.

For the practice itself, the incident carries operational, regulatory, and reputational consequences. Healthcare providers must assess notification obligations under applicable privacy rules, evaluate the integrity of remaining systems, and restore confidence among patients. The unknown scale of the exfiltration leaves both the organization and its community without a clear picture of residual risk, which itself prolongs uncertainty.

Were you affected?

If you are a current or former patient or employee of Medical Center, LLP, begin by monitoring financial and medical statements for unfamiliar activity. Consider placing fraud alerts with the major credit bureaus and reviewing any explanation-of-benefits notices carefully. Keep records of communications from the practice regarding the incident, and follow any official guidance it issues about credit monitoring or identity-protection services.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your broader exposure. Remain cautious of unsolicited messages that claim to relate to the breach and request personal information; verify any outreach through official channels before responding.

AICompiled with AI assistance from public sources and published under our editorial standards.