Tri-Century Eye Care Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers because patient records and operational files carry lasting value for extortion and secondary misuse. In this climate, listings on criminal leak sites have become a common way attackers pressure organisations, even when independent confirmation of what was taken remains limited.

On 3 September 2025, Tri-Century Eye Care was listed by the ransomware group known as pear. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and further technical detail has not been disclosed. For patients and staff connected to an eye-care practice, any such claim raises immediate questions about what may have left the organisation’s systems.

Breaking down the breach

According to available public reporting, Tri-Century Eye Care appeared on a leak site associated with the pear ransomware group on 3 September 2025. The reported summary indicates that internal files were exfiltrated during a ransomware attack. No figure has been given for the number of individuals whose information may be involved, and the precise method of initial access, the volume of data, or any ransom demand have not been made public. The listing itself constitutes a claim by the group; independent verification of the full scope of the incident has not been provided in the facts available.

Healthcare organisations are frequent targets because their systems often contain both clinical and administrative records. In this case, the only concrete description offered is that internal files were taken. Timing beyond the reported listing date, the exact systems affected, and any subsequent containment steps remain undisclosed.

The group behind it: pear

Pear operates as a ransomware group that, like many of its peers, is known to combine encryption of victim systems with data theft. Publicly documented activity by such groups typically involves gaining access, exfiltrating files, and then listing the organisation on a dedicated leak site to increase pressure for payment. The group claims that Tri-Century Eye Care’s internal files were taken; that claim has not been independently confirmed in the material provided. Established patterns for groups of this type include threatening to publish stolen data if negotiations fail, though no specific statements by pear about this victim beyond the listing itself are recorded here.

These actors generally favour organisations whose data is sensitive enough to create urgency. Healthcare providers fit that profile. No additional claims by pear regarding dollar amounts, file counts, or particular documents from Tri-Century Eye Care appear in the facts.

About Tri-Century Eye Care

Tri-Century Eye Care is described as a practice in which ophthalmologists and optometrists deliver comprehensive and sub-specialty eye care to patients of all ages. Organisations of this kind maintain clinical records, appointment systems, billing information, and administrative files necessary for day-to-day operations. Because eye-care practices handle protected health information and personal identifiers, a ransomware incident that involves exfiltration carries consequences beyond temporary disruption of services.

A breach claim against such a provider is consequential precisely because the data typically held can be reused for identity fraud, insurance misuse, or targeted social engineering. The organisation’s role in ongoing patient care also means any prolonged system outage can affect scheduling and continuity of treatment, even when the full extent of data exposure remains unconfirmed.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as patient names, medical histories, contact details, insurance numbers, or staff records—has been disclosed. For an eye-care practice, internal files would ordinarily include clinical notes, imaging results, demographic data, and operational documents. Those categories are typical for the sector; they are not confirmed as present in this incident.

Because the exact contents remain unconfirmed, it is not possible to state with certainty which individuals or which specific records were involved. The absence of a disclosed count of affected people further limits any precise assessment of scale.

What's at stake

For people whose information may have been among the internal files, the practical risks include potential misuse of personal or medical details for fraud, phishing, or unauthorised access to other accounts. Medical data can be particularly durable; once it leaves an organisation’s control, it can surface later in secondary markets or social-engineering attempts. For the organisation itself, the stakes include operational disruption, regulatory notification duties, and the need to verify the integrity of remaining systems.

Because the number of people affected is unknown and the precise data types are not listed beyond “internal files,” the concrete impact on any individual cannot yet be measured. The claim alone is sufficient reason for caution among patients and staff who have interacted with the practice.

If your data was in this claimed breach

If you have been a patient or employee of Tri-Century Eye Care, treat the listing as a prompt to take measured protective steps rather than as confirmed proof that your records were taken. Practical first actions include:

• Monitor financial and insurance statements for unfamiliar activity and place fraud alerts with credit bureaus if you notice anomalies.
• Change passwords on any accounts that may have reused credentials linked to the practice, and enable multi-factor authentication where available.
• Be alert to unexpected emails or calls that reference eye-care appointments or medical details; verify such contacts through official channels.
• Request an accounting of disclosures from the practice if you believe your records may be involved, once formal notifications are issued.
• Run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets.

Public detail on this incident remains limited to the September 2025 listing and the statement that internal files were allegedly exfiltrated. Further clarity will depend on official statements from the organisation or regulatory filings. Until then, the steps above reduce residual risk without assuming more than the available facts support.

AICompiled with AI assistance from public sources and published under our editorial standards.