Western Orthopaedics Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Patients and staff connected to Western Orthopaedics may now face uncertainty over whether their personal or clinical information has been taken by criminals. On 30 September 2025 the orthopaedic practice appeared on a ransomware group’s leak site, raising the practical risk that internal files could be misused for identity fraud, targeted scams or further intrusion into related medical accounts.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the files have not been independently confirmed. What is known is that the listing itself signals a claimed ransomware attack involving data theft, which is enough to warrant careful attention from anyone who has received care or worked at the practice.

What happened

Western Orthopaedics was listed by the ransomware group pear on 30 September 2025. According to the available report, the group claims that internal files were exfiltrated during a ransomware attack. No further operational details—such as the initial access method, the exact date of intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public record. The number of individuals potentially affected is listed as unknown. The listing itself constitutes an unverified claim by the group rather than an independently confirmed disclosure by the organisation or regulators.

Inside pear

Pear is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Like other groups in this category, pear typically advertises victims on its dark-web portal, sometimes releasing sample files to pressure organisations. Public reporting on pear has documented its use of standard ransomware tooling and its focus on mid-sized organisations across multiple sectors, including healthcare. No statements attributed specifically to this Western Orthopaedics incident beyond the leak-site listing itself have been made public, so any claims about the volume or sensitivity of the stolen material remain those of the group alone.

Western Orthopaedics and its sector

Western Orthopaedics is a medical practice focused on orthopaedic surgery, musculoskeletal conditions, sports injuries and spinal conditions. Organisations of this type routinely hold patient demographic data, medical histories, imaging reports, insurance details, appointment records and staff information. Healthcare providers are attractive targets for ransomware groups because the data they store is both sensitive and difficult to change, and because operational disruption can create immediate pressure to restore systems. A breach at such a practice therefore carries consequences that extend beyond financial loss to the privacy and safety of patients who may have shared detailed health information in confidence.

What was likely exposed

The only data type named in the public report is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, patient counts or document types has been released. Orthopaedic practices typically maintain electronic health records containing names, dates of birth, addresses, contact details, diagnosis codes, treatment notes, surgical reports, billing information and insurance identifiers. Staff records may include payroll and credentialing data. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were among the files taken. Readers should treat the exposure as potentially broad until official notifications or forensic findings provide clarity.

What's at stake

For individuals, the primary risks are identity theft, medical identity fraud and highly targeted phishing that references real appointments or conditions. Stolen clinical data can be used to open fraudulent insurance claims or to craft convincing social-engineering messages. For the practice itself, the consequences include potential regulatory scrutiny under health-privacy rules, notification costs, possible litigation, reputational damage and the operational expense of system restoration and enhanced monitoring. Because the scale of the incident is unknown, both patients and the organisation face an extended period of uncertainty while the full impact is assessed.

Were you affected?

If you have been a patient or employee of Western Orthopaedics, monitor financial and medical statements for unexpected activity, enable multi-factor authentication on email and patient-portal accounts, and be sceptical of unsolicited messages that reference orthopaedic care. Consider placing a fraud alert with credit bureaux and requesting a free copy of your medical records to check for unauthorised entries. You can also run a free exposure scan of your email address to see whether it has already appeared in known breach data sets; this provides an early indication of whether your information is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.