Software Answers, a Banyan Software Listed by Pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Pear, a ransomware and extortion group, has listed Software Answers, a Banyan Software company, on its leak site, according to a report dated October 01, 2026. Public detail is limited: the listing does not establish confirmed theft, exposure, or leak of any specific files, and Software Answers has not publicly stated the incident as of writing. The claim matters because the firm serves the long-term stay accommodation sector—corporate housing and serviced apartments—where operators and their software vendors often handle business, guest, and operational records that could, if misused, create follow-on risk for organisations and individuals.

Nothing in the public listing, as summarised in available facts, verifies scale, method, or contents. Readers should treat the appearance on a leak site as an unverified allegation by the named group until the company, a regulator, or another independent source confirms otherwise.

What the listing says

The available facts state that Software Answers, a Banyan Software, was listed by the Pear ransomware group, with the report dated October 01, 2026. The number of people affected is unknown. Data types named as exposed are not disclosed. The reported summary describes the organisation as a software company serving the long-term stay accommodation industry, including corporate housing and serviced apartments.

Timing of any alleged intrusion, technical method, ransom demand, file volume, and whether any sample material was posted are undisclosed in the facts provided. A leak-site listing is a form of pressure commonly used by extortion crews; it is a claim by the group, not a verified inventory of what, if anything, left the victim’s environment. Software Answers has not publicly confirmed the claim as of writing.

Who is Pear?

Pear is known publicly as a ransomware and data-extortion actor that pressures organisations by encrypting systems and/or threatening to publish material on a dedicated leak site. Like other groups in this category, it typically seeks payment in exchange for decryption keys and for withholding or deleting claimed data. Public reporting on such actors generally describes double-extortion patterns: disruption inside the network paired with the threat of exposure to customers, partners, and regulators.

Notable prior activity attributed to Pear in open sources follows that same playbook—victim names posted, countdowns or staged releases used as leverage, and marketing-style descriptions of stolen data that should be read as the attacker’s claims rather than audited fact. For this listing specifically, the facts only support that Pear has named Software Answers on its site; they do not independently prove what Pear obtained or how. Any statement that “Pear stole X from Software Answers” would go beyond what is established here.

Software Answers, a Banyan Software and its sector

Software Answers is identified in the facts as a Banyan Software company that provides software for the long-term stay accommodation industry, including corporate housing and serviced apartments. That sector sits between hospitality and residential property management: operators place employees, relocating staff, project teams, and other guests in furnished units for weeks or months, often under corporate contracts.

Vendors in this niche typically supply booking, property, billing, and guest-lifecycle tools used by housing providers and their corporate clients. A listing that names such a vendor draws attention because the software layer can sit close to reservation data, company accounts, invoices, and communications that support stays. Whether any of that material was involved here is unconfirmed. The consequential point is sectoral: if a claim against a specialist vendor were later substantiated, the blast radius could extend beyond one firm to the operators and corporate customers who rely on the same systems—not because negligence has been proven, but because of how information flows in this industry.

A leak-site entry alone does not establish how Software Answers designs, monitors, or responds to security events. It establishes only that an extortion group chose to name the company publicly.

The information in question

The facts state that data types named as exposed are not disclosed. It is therefore not possible to assert that any particular category of record was taken. Pear’s listing description, where groups often advertise folders or sample files, should be treated as attacker marketing, not a confirmed inventory.

If files were taken from a software provider in the corporate housing and serviced-apartment space, organisations of this kind typically hold or process some mix of business contact details, contract and billing records, property and unit information, reservation or stay metadata, and internal operational documents. Guest or employee personal data can appear in such systems depending on product design and customer configuration, but that is a general sector pattern, not a finding about this incident. Exact contents, sensitivity, and whether any personal data was involved remain unconfirmed.

The real-world impact

For people who interact with Software Answers’ customers—corporate travel and relocation contacts, guests in long-term stays, property staff, or vendor employees—the practical risk is conditional. If personal or account data were among materials the group claims, possible outcomes include targeted phishing that references real stays or employers, invoice or payment fraud aimed at corporate housing buyers, and reuse of passwords if the same credentials appear elsewhere. None of that is established as having occurred from this listing alone.

For the organisation and its clients, an unverified extortion listing can still create operational and reputational pressure: customers may ask for assurances, insurers and partners may open inquiries, and staff may face social-engineering attempts that cite the public claim. If systems were disrupted in a typical ransomware scenario, temporary loss of booking or billing tools could affect housing operators; again, disruption is not confirmed in the facts given.

People affected are listed as unknown. Without confirmation of scope, no one should assume their records are or are not involved. The listing does not, by itself, prove identity theft, financial loss, or mass exposure.

What to do now

If you are a customer, partner, or individual who may have data in systems used for corporate housing or serviced apartments tied to this vendor, treat the situation as precautionary until Software Answers or an official source confirms details. Prefer official channels for any notice from the company; do not trust unsolicited messages that cite the Pear listing and urge urgent payment or credential entry. If you use related portals, enable multi-factor authentication where available, and use unique passwords so that a compromise elsewhere cannot be replayed.

Monitor bank and card statements and corporate accounts payable for unexpected charges or changed payment instructions. If you later receive a confirmed notice that your information was involved, follow the specific steps in that notice—credit monitoring, password resets, or fraud alerts as appropriate. Because the data types here are not disclosed, avoid assuming what was or was not taken.

As a general check, readers can run a free exposure scan of their email addresses against known breach datasets to see whether their addresses or related credentials have already appeared in unrelated, previously published incidents. That does not prove involvement in this Pear listing, but it can highlight accounts that need stronger protection regardless of how this claim develops.

AICompiled with AI assistance from public sources and published under our editorial standards.