Preferred Homes Realty Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Preferred Homes Realty, a real-estate firm serving communities in Illinois’s Fox Valley area, was listed on July 09, 2025 by the ransomware group known as pear. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and no further technical details have been released.

The listing itself is a claim by the group. What is confirmed so far is limited to the organization’s name, the reported date, and the description of internal files taken. That limited record is still enough to matter for anyone who has bought, sold, or listed property through the firm, because real-estate offices routinely handle documents that can be reused for fraud or identity theft.

Inside the incident

According to the available record, Preferred Homes Realty appeared on pear’s leak site on July 09, 2025. The only data description provided is that internal files were allegedly exfiltrated during a ransomware attack. No statement has been issued confirming whether systems were encrypted, whether a ransom demand was made, or whether any files have been published. The scale of the incident—how many records, which systems, or how long the intrusion lasted—has not been disclosed. People affected are listed simply as unknown. In short, the public facts stop at the claim of exfiltration of internal files and the date of the listing.

The group behind it: pear

Pear is a ransomware operation that, like other groups in this category, typically gains access to a network, steals data, and then threatens to publish or sell it unless payment is made. Public reporting on such groups shows they often use phishing, compromised remote-access credentials, or unpatched software as initial entry points, then move laterally to locate file servers and backups. Once data is copied out, the group posts the victim’s name on a dedicated leak site as leverage. In this case the group claims Preferred Homes Realty is a victim and that internal files were taken; that claim has not been independently verified by the firm or by law-enforcement statements available in the public record. No additional statements attributed specifically to pear about this particular company have been released beyond the listing itself.

Preferred Homes Realty and its sector

Preferred Homes Realty operates as a residential real-estate brokerage focused on the Elgin, South Elgin, West Dundee, Bartlett, Huntley, Hampshire, Gilberts, St. Charles, Geneva and surrounding Fox Valley towns. Firms of this type maintain client contact lists, property listings, transaction files, mortgage-related paperwork, and correspondence with buyers, sellers, and lenders. Because the business depends on trust and on the secure handling of personal and financial documents, any confirmed or claimed breach raises immediate questions about the confidentiality of those records. The sector as a whole has seen repeated targeting by ransomware groups precisely because the data held is both sensitive and relatively portable.

What data was at risk

The only concrete description given is “internal files exfiltrated in ransomware attack.” Exact file names, record counts, or categories of personal information have not been disclosed. Organizations in residential real estate typically store names, addresses, phone numbers, email addresses, Social Security numbers or tax identifiers, bank-account details used for earnest-money deposits, copies of driver’s licenses, and signed contracts. Whether any of those categories were among the files taken remains unconfirmed. Until the firm or investigators release a more precise inventory, the public can only note that the claimed exfiltration involved internal material and that the precise contents are still unknown.

Why it matters

For individuals who have worked with Preferred Homes Realty, the practical risk is that personal details could be used for phishing, account takeover, or synthetic-identity fraud. Even limited contact information can be combined with other publicly available data to craft convincing scams. For the firm itself, the incident creates operational and reputational pressure: clients may request confirmation that their files were not involved, and regulators or insurers may seek evidence of the scope of the event. Because the number of people affected is unknown and the exact data types remain undisclosed, the full extent of those risks cannot yet be measured. The absence of further detail does not eliminate the need for caution; it simply means any response must be based on the limited facts that exist.

What to do if you're exposed

If you have bought, sold, or listed property through Preferred Homes Realty, treat the situation as a potential exposure until clearer information appears. Practical first steps include:

• Monitor bank and credit-card statements for unfamiliar activity and enable transaction alerts.
• Place a free fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may have been involved.
• Be skeptical of unexpected emails or calls that reference a real-estate transaction or request personal verification.
• Change passwords on any accounts that used the same email address you shared with the firm, and enable multi-factor authentication where available.
• Keep records of any notices you receive from the company so you can compare them with later official statements.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Doing so provides an additional data point but does not replace the steps above. Until Preferred Homes Realty or investigators release a fuller accounting, these measures remain the most direct way for individuals to reduce personal risk.

AICompiled with AI assistance from public sources and published under our editorial standards.