Optimum First Mortgage Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 19, 2026, the ransomware group pear listed Optimum First Mortgage on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of individuals affected has not been disclosed, and no further details on the volume or contents of the material have been made public. This incident occurs against a backdrop of sustained ransomware activity targeting financial services providers, where attackers increasingly combine encryption with data theft to pressure victims.

Inside the incident

The only confirmed information is the date the listing appeared and the description of internal files being removed. No timeline for the initial intrusion, the method of access, or the scale of the operation has been released by either the organization or the group. The number of people whose information may be involved remains unknown.

The group behind it: pear

Pear is a ransomware operation that follows the double-extortion model common among current threat actors. It typically gains access through phishing, stolen credentials or unpatched systems, deploys ransomware to disrupt operations, and removes data before encryption. The group then posts victim names on a leak site when ransom demands are not met, presenting the action as evidence of the theft. Its listings function as a claim rather than independently verified proof of compromise.

Optimum First Mortgage and its sector

Optimum First Mortgage operates as a mortgage lender offering home purchase and refinancing services. Organizations in this sector routinely process loan applications that contain personal identifiers, employment records, bank details and property information. A breach at such a firm is consequential because the data supports long-term financial decisions and remains relevant for years after a transaction closes.

What was likely exposed

The listing states that internal files were exfiltrated. No specific categories of data have been confirmed. Mortgage companies of this type commonly store customer names, addresses, Social Security numbers, income documentation, credit reports and account numbers. The precise contents of the exfiltrated material have not been disclosed.

What's at stake

Individuals whose records appear in the files could face risks of identity theft or account takeover if the material reaches criminal marketplaces. The organization may encounter regulatory scrutiny, legal costs and operational disruption while restoring systems. Both outcomes depend on factors that remain unconfirmed, including whether the files contain personal data and whether any of it is later distributed.

What to do if you're exposed

Review bank and credit card statements for unusual activity and place fraud alerts or credit freezes with the major bureaus if statements show unexpected inquiries. Change passwords for any financial accounts and enable multi-factor authentication. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.