Phillips Feldman Group Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Phillips Feldman Group, a South Florida firm that provides personalized financial guidance to individuals and businesses, has been listed by the ransomware group known as pear. The listing was reported on September 15, 2025. Public detail remains limited: the number of people affected is unknown, and the only description of exposed material is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group rather than an independently confirmed disclosure.

For clients and partners of a financial-advisory practice, any unauthorized access to internal files raises practical questions about what may have left the firm’s systems and what steps those potentially affected can take while fuller details are still unavailable.

What happened

According to the available record, Phillips Feldman Group was listed by the pear ransomware group on September 15, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No further public information has been released about the date the intrusion began, how long it lasted, the technical method used, or the precise volume of data taken. The number of individuals or entities whose information may have been involved is listed as unknown. Because the primary source is a leak-site listing, the claim that Phillips Feldman Group was successfully compromised and that files were removed remains an assertion by the threat actor until corroborated by the organization or by independent investigators.

The group behind it: pear

Pear operates as a ransomware group that, like many of its peers, maintains a public leak site on which it names victims and sometimes posts samples or full archives of stolen data. Such groups typically gain initial access through phishing, compromised credentials, or unpatched remote services, then move laterally, exfiltrate files, and deploy encryption to pressure the victim into paying a ransom. Public reporting on pear has described the group as following this double-extortion pattern—threatening to publish stolen material if payment is not made. No additional claims specific to Phillips Feldman Group beyond the listing itself have been documented in the available facts; therefore any statements about the firm’s data or the group’s demands regarding this incident should be treated as unverified assertions by pear.

Phillips Feldman Group and its sector

Phillips Feldman Group is described as offering quality, personalized financial guidance to individuals and businesses in South Florida. Firms of this type typically handle client identity information, account details, tax records, investment holdings, estate-planning documents, and internal correspondence that may contain sensitive commercial or personal data. Because the firm sits at the intersection of personal finance and business advisory work, a breach can affect both private clients and corporate entities that rely on the same practice. In the financial-services sector, even limited internal-file exposure can create downstream risk for identity theft, account takeover, or competitive harm, which is why listings of this kind draw attention even when exact data inventories remain undisclosed.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. Exact contents, file counts, and whether client records were included have not been confirmed. Organizations providing personalized financial guidance commonly maintain the following categories of material; any of these could theoretically have been among the files taken, yet none can be asserted as fact for this incident:

• Client contact and identity documents
• Account statements, tax forms, and investment records
• Internal correspondence and work papers
• Business contracts and proprietary planning materials

Until Phillips Feldman Group or a regulatory filing provides a verified inventory, the precise nature of the exposed data remains unconfirmed.

What's at stake

For individuals and businesses that have worked with Phillips Feldman Group, the primary concern is the possible misuse of any personal or financial information that may have been among the internal files. Risks include targeted phishing that references real account details, attempts to open new credit or investment accounts in a client’s name, or the quiet sale of data on underground markets. For the firm itself, the listing can affect client trust, trigger regulatory notification obligations under state and federal privacy rules, and require forensic and legal expense. Because the scale of the incident is still unknown, the concrete impact on any single person or entity cannot yet be measured; the prudent stance is to treat the possibility of exposure seriously while awaiting clearer confirmation.

What to do if you're exposed

If you are a current or former client of Phillips Feldman Group, begin by monitoring financial accounts and credit reports for unexpected activity. Consider placing a fraud alert or credit freeze with the major credit bureaus, and be cautious of unsolicited emails or calls that reference the firm or your financial arrangements. Keep records of any communications you receive that appear related to the incident. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such a scan does not confirm involvement in this specific event but can surface other compromises that warrant attention. Continue to watch for official statements from Phillips Feldman Group or from regulators that may clarify what was taken and who is affected.

AICompiled with AI assistance from public sources and published under our editorial standards.