Riddell Law Group Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 15, 2025, Riddell Law Group was listed by the ransomware group known as pear. Public reporting indicates that the group claims internal files were exfiltrated during a ransomware attack against the firm. The number of people affected remains unknown, and further operational details have not been disclosed.

This matters because Riddell Law Group operates in sensitive legal practice areas involving real estate, estates, and financial distress. Any compromise of internal files raises the possibility that client and firm records could be exposed, even while the precise scope stays unconfirmed.

Breaking down the breach

The available facts establish only that Riddell Law Group appeared on a listing associated with the pear ransomware group on October 15, 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figures have been released for the volume of data taken, the number of individuals whose information may be involved, or the exact timeline of the intrusion. Methods of initial access, encryption status of systems, and any ransom demand remain undisclosed in public reporting. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

In the absence of additional disclosures from the firm or regulators, the incident is best understood as a reported ransomware event involving claimed data theft. Scale and technical specifics are simply not public at this stage.

Inside pear

Pear is a ransomware group that operates in the established pattern of many modern cybercriminal actors: it encrypts victim systems and simultaneously claims to exfiltrate data, then pressures the organization by threatening to publish the material on a dedicated leak site if payment is not made. This double-extortion model has become standard among ransomware crews. Groups of this type typically advertise victims on dark-web portals, listing the organization name and sometimes a sample of stolen files to demonstrate access. Prior public activity attributed to pear follows this same playbook of claiming data theft and setting publication deadlines.

Importantly, a leak-site listing is an assertion by the group. It does not automatically prove that every file claimed was taken or that the data has been released. In this case, the facts state only that Riddell Law Group was listed and that internal files are said to have been exfiltrated; no further claims specific to this victim beyond that listing are part of the public record used here.

Riddell Law Group and its sector

Riddell Law Group is a legal practice whose reported areas of work include real estate law, title insurance, probate and estate planning, bankruptcy, and foreclosures or short sales. Firms of this type routinely handle transactions and disputes that require detailed personal, financial, and property records. The legal sector as a whole is a frequent target for ransomware operators because the data it holds is both sensitive and difficult to replace quickly, and because downtime can disrupt court filings, closings, and client deadlines.

A breach at such an organization is consequential precisely because the work involves confidential client matters. Even when the exact contents of any stolen files remain unconfirmed, the nature of the practice areas means that personal identifiers, financial statements, property documents, and estate-related information are the kinds of records typically present in internal systems. Clients and counterparties therefore have a legitimate interest in understanding what is known and what remains unknown.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of specific data categories—such as names, Social Security numbers, bank details, or case files—has been publicly itemized. The number of people potentially affected is listed as unknown.

Organizations operating in real estate law, title insurance, probate, estate planning, bankruptcy, and foreclosure work ordinarily maintain client contact information, identification documents, financial records, property deeds or title abstracts, wills and trust instruments, and correspondence related to legal proceedings. These are the types of materials that could be present among internal files. However, because the exact contents of the claimed exfiltration have not been disclosed or independently verified, it is not possible to state with certainty which of these categories, if any, were involved. The public record stops at the claim of internal-file theft.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal or financial details for fraud, identity theft, or social-engineering attempts. Even without confirmed data types, the possibility of exposure warrants caution. Clients involved in ongoing real-estate closings, estate administrations, or bankruptcy proceedings could face delays or additional verification steps if systems were disrupted.

For the firm itself, a ransomware incident typically brings operational interruption, the cost of investigation and recovery, potential regulatory notification obligations, and reputational questions from clients and counterparties. Because the number of affected people and the precise data set remain unknown, the full extent of these consequences cannot yet be measured. The situation is one of elevated but still unquantified risk rather than a fully mapped incident.

If your data was in this claimed breach

If you have been a client of Riddell Law Group or have reason to believe your information may have been stored in its systems, begin with basic protective steps. Monitor financial accounts and credit reports for unexpected activity. Consider placing a fraud alert or credit freeze with the major credit bureaus. Change passwords on any accounts that reused credentials potentially stored by the firm, and enable multi-factor authentication wherever available. Be alert to phishing messages that reference legal, real-estate, or estate matters and that attempt to harvest further information.

Because the full scope of this incident is still unconfirmed, it is also useful to check whether your email address has already appeared in other known breach data sets. Readers can run a free exposure scan of their email to see whether their information has surfaced in previously documented breaches. Stay attentive to any official notifications that may be issued by the firm or by regulators as more details become available.

AICompiled with AI assistance from public sources and published under our editorial standards.