Twin Oaks Presbyterian Church Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Twin Oaks Presbyterian Church was listed by the ransomware group known as pear on or around July 03, 2025. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further technical details have not been disclosed. The listing itself is a claim by the group rather than independent confirmation of every asserted detail.

For a congregation centered on worship, discipleship, and outreach, any unauthorized access to internal files raises practical concerns about the privacy of members, staff, and community contacts. Exact scope is limited in public sources, so the picture rests on what has been reported so far.

Breaking down the breach

According to available information, Twin Oaks Presbyterian Church appeared on a listing associated with the pear ransomware group, reported on July 03, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No public figures have been given for the volume of data, the precise date of initial intrusion, the method of access, or the number of individuals whose information may be involved. People affected are listed as unknown. Timing beyond the report date, scale, and technical method remain undisclosed in the facts provided.

Ransomware incidents of this type typically involve encryption of systems combined with data theft, followed by a threat to publish the material if demands are unmet. In this case, the public record is confined to the group's listing of the church and the statement that internal files were taken. No independent verification of the full contents or of any ransom negotiation has been supplied in the source material.

Inside pear

Pear is a ransomware group that operates in the established pattern of double-extortion actors: operators gain access to networks, exfiltrate data, encrypt systems, and then post victim names on leak sites while threatening to release the stolen material. Such groups commonly use phishing, compromised credentials, or unpatched remote services as initial vectors, though the specific entry point used against any single target is rarely confirmed publicly unless the victim or investigators disclose it. Pear, like other documented ransomware crews, has previously listed organizations across multiple sectors and claimed responsibility for data theft in those cases. Claims appearing on a group's leak site are assertions by the actors themselves and should be treated as unverified until corroborated by the victim or forensic reporting.

No statements attributed to pear beyond the listing of Twin Oaks Presbyterian Church and the general claim of internal-file exfiltration are present in the facts for this incident. Background on the group's typical tactics is drawn from the broader public record of ransomware operations and does not invent incident-specific details.

About Twin Oaks Presbyterian Church

Twin Oaks Presbyterian Church is a religious congregation whose stated focus is worship, discipleship, and outreach. Churches of this kind ordinarily maintain records related to membership, attendance, pastoral care, volunteer coordination, donations, and community programs. They may also hold contact details for staff, congregants, and partner organizations, as well as internal administrative documents. These materials are often stored on church servers, cloud services, or office systems used for day-to-day operations.

A breach involving a house of worship is consequential because the data frequently includes personal and sometimes sensitive information about individuals who trust the institution with their details. Even when the exact files remain unconfirmed, the potential exposure of such records can affect privacy, trust within the community, and the church's ability to continue its work without disruption. Public detail on the size of the congregation or its specific IT environment is not provided in the source material.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No further breakdown of file types, databases, or categories of personal information has been disclosed. Organizations such as churches typically hold membership directories, donation and financial records, email correspondence, staff personnel files, event registrations, and pastoral notes. Whether any of those categories were among the files taken in this incident is unconfirmed.

Because the precise contents have not been published or independently verified, it is not possible to state that specific data elements were exposed. The only confirmed description remains the general reference to internal files. Readers should treat any more detailed claims circulating elsewhere as unverified unless supported by official statements from the church or law-enforcement reporting.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include unwanted contact, phishing attempts that reference church affiliation, or misuse of personal details for identity-related fraud. Even limited contact lists can enable social-engineering attacks that appear legitimate because they reference a trusted community organization. For the church itself, consequences can include temporary disruption of operations, costs associated with investigation and recovery, and the need to notify members and regulators where required by law. Reputational strain within the congregation is also a common secondary effect when trust in data handling is called into question.

Because the number of people affected is unknown and the exact data types remain undisclosed, the scale of these risks cannot be quantified from public sources. The impact is therefore best understood as potential rather than measured: anyone connected to the church should remain alert to unusual communications and monitor accounts for signs of misuse, while the organization works through its response.

What to do if you're exposed

If you have a connection to Twin Oaks Presbyterian Church—as a member, staff member, donor, or volunteer—consider the following practical steps:

• Monitor bank, credit-card, and email accounts for unexpected activity and enable multi-factor authentication where available.
• Treat unsolicited messages that reference the church or request personal or financial details with caution; verify through official channels before responding.
• Place a fraud alert or credit freeze with the major credit bureaus if you believe financial or identity data may have been involved.
• Update passwords on any accounts that may have shared credentials with church-related systems, using unique passwords for each service.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or underground collections.

These measures do not depend on confirmation of every detail of the incident; they are standard precautions when a trusted organization reports or is claimed to have suffered data exfiltration. Official guidance from the church, if issued, should take precedence for members seeking specific next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.