Reynolds & Reynolds Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target software and services providers that sit at the centre of large industry ecosystems, using data theft and public leak-site listings as leverage. In this environment, even an unconfirmed claim of compromise can raise practical questions for customers, partners and individuals whose information may be held by the affected organisation.

On 2 September 2025, the ransomware group known as pear listed Reynolds & Reynolds on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and the precise contents of any stolen material have not been independently confirmed. The listing itself is a claim by the group rather than a verified disclosure by the company.

What happened

According to available reporting, Reynolds & Reynolds was listed by the pear ransomware group on 2 September 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further public information has been released about the date of any intrusion, the method of access, the volume of data involved, or whether systems were encrypted. The number of people potentially affected is unknown. Because the primary source of the claim is the group’s own leak-site listing, the incident should be treated as an unverified assertion until additional confirmation appears.

The group behind it: pear

Pear is a ransomware operation that follows the now-familiar double-extortion model: operators claim to steal data before or during encryption and then threaten to publish it if a ransom is not paid. Like other groups of this type, pear maintains a public leak site on which it posts victim names and, in some cases, samples or larger archives of stolen material. Public reporting on pear has described it as opportunistic rather than highly specialised, often focusing on mid-sized and larger organisations whose data may include operational records, customer information or internal documents. The group’s listing of Reynolds & Reynolds is presented by pear as evidence of a successful attack; that claim has not been independently verified in the material available for this account.

Reynolds & Reynolds and its sector

Reynolds & Reynolds is a long-established provider of automotive retailing solutions. Its software and services help car dealerships manage sales, inventory, finance, customer relationships and day-to-day operations. Organisations of this kind typically sit between manufacturers, dealers and consumers, handling large volumes of business records and, in many cases, personal data linked to vehicle purchases, financing and service. A breach affecting such a provider can therefore have consequences that extend beyond the company itself to the dealerships that rely on its platforms and to the individuals whose information those platforms process. Public detail on the exact scope of any compromise at Reynolds & Reynolds remains limited.

The information in question

The only data type named in connection with the listing is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific document categories, databases or personal-data fields has been published. Companies that supply dealership-management systems commonly hold operational records, employee information, customer contact and transaction data, and technical configuration material. Whether any of those categories were among the files claimed by pear is unconfirmed. Until more precise disclosure appears, the exact contents of the material remain unknown.

The real-world impact

For individuals, the principal risks associated with any exposure of internal files from an automotive-retailing software provider include potential misuse of personal or financial details if such data were present, and the possibility of targeted phishing that references genuine dealership or vehicle-related information. For dealerships that use Reynolds & Reynolds systems, operational disruption, temporary loss of access to records, or the need to re-verify customer data could arise if systems were affected. For the organisation itself, the listing creates reputational pressure and the practical burden of investigation, customer notification and any required regulatory reporting. Because the scale of the claimed exfiltration and the precise data types remain undisclosed, the concrete impact on any given person or dealership cannot yet be quantified.

Were you affected?

If you have done business with a dealership that uses Reynolds & Reynolds systems, or if you are an employee or partner of the company, consider the following practical steps:

• Monitor financial and credit accounts for unexpected activity and enable available fraud alerts.
• Treat unsolicited emails or calls that reference vehicle purchases, financing or dealership accounts with caution; verify any request through known official channels.
• Change passwords on related accounts and enable multi-factor authentication where it is offered.
• Retain any official notifications you receive from the company or from dealerships and follow the guidance they provide.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this particular incident is still limited; further clarity will depend on additional statements from the organisation or independent verification of the group’s claims.

AICompiled with AI assistance from public sources and published under our editorial standards.