Westside GI Listed by Pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group calling itself Pear has listed Westside GI on its leak site, according to a report dated September 24, 2026. The listing is an accusation from an extortion crew, not a confirmation from the organization, a regulator, or an independent breach index. As of writing, Westside GI has not publicly confirmed the claim.

For patients and others who may have dealt with an ambulatory endoscopy center, the practical stakes are straightforward: if personal or clinical information were ever taken and published, it could be misused for identity fraud, insurance abuse, or targeted scams. Nothing in the public listing establishes that any specific person’s data is involved, or that files left the organization at all. What follows treats the listing as a claim and explains what is and is not known.

Inside the listing

Pear has listed Westside GI on its leak site. The reported summary describes the organization as an ambulatory endoscopy center. Beyond that label, public detail in the material provided is limited. The number of people potentially affected is unknown. Data types named as exposed are not disclosed. Timing of any alleged intrusion, technical method, ransom demand, and whether any files were actually released are undisclosed in the facts available for this article.

Leak-site listings are a pressure tactic. Groups post a victim name, sometimes with sample files or countdown language, to push payment. A name on a leak site does not by itself prove theft, completeness of any haul, or that published material is authentic or new. Recycled data from older incidents and exaggerated claims are known problems in this ecosystem. Until the organization or a competent authority speaks, the listing remains an unverified claim by Pear.

Who is Pear?

Pear is known publicly as a ransomware and extortion-style actor. Groups in this category typically encrypt systems or exfiltrate data—or claim to—and threaten to publish material on a dedicated leak site if their demands are not met. Operations often involve affiliate-style models, double extortion (encryption plus leak threats), and staged releases meant to increase pressure on the named organization.

Public reporting on such groups generally covers patterns: opportunistic targeting across sectors, use of stolen credentials or common intrusion paths in many campaigns industry-wide, and marketing-style descriptions of “stolen” data that should not be read as audited inventories. For this specific listing, only what appears in the reported facts should be attributed to Pear’s claim about Westside GI. No further victim-specific statements from the group are included in the material provided here.

Who is Westside GI?

Westside GI is identified in the listing-related summary as an ambulatory endoscopy center. Organizations of this kind provide outpatient gastrointestinal procedures such as endoscopy and related diagnostic or therapeutic services. They sit in the broader healthcare and specialty ambulatory-care sector, where scheduling, clinical documentation, billing, and insurance coordination are routine.

A claim against a provider in this sector draws attention because clinical and administrative records can be sensitive. That consequence follows from the nature of the work, not from any proven event. The listing does not establish that Westside GI systems were compromised, that records left its control, or that any particular patient population is affected. It establishes only that Pear has named the organization on a leak site.

The information in question

The facts state that data types named as exposed are not disclosed. Exact contents of any alleged package are therefore unconfirmed. It would be improper to treat an attacker’s marketing language as a verified inventory.

If files from an ambulatory endoscopy center were ever taken, organizations in this sector typically hold some mix of identifiers and care-related records—for example names and contact details, dates of birth, insurance or billing information, referral and appointment data, procedure notes, and other protected health information under applicable privacy rules. That is a description of sector norms, not a statement of what, if anything, Pear holds. People affected, if any, remain unknown. Readers should treat any specific file claims from a leak site as unverified until corroborated by the organization or official sources.

The real-world impact

Impact depends entirely on whether a real intrusion occurred and what, if anything, was copied. Conditional risks for individuals in healthcare-adjacent incidents often include account takeover attempts, fraudulent insurance claims, phishing that references a real clinic name, and long-lived exposure of identifiers that are hard to change. Clinical details, if involved, can be embarrassing or damaging in employment or personal contexts even when they are not useful for classic financial fraud.

For the organization, a public extortion listing can mean operational distraction, patient concern, legal and regulatory inquiry if a breach is later confirmed, and reputational strain—again, outcomes that follow confirmed incidents in the sector generally, not findings about this case. A leak-site entry alone does not prove negligence, failed controls, or poor culture; those judgments would require an established incident and evidence that is not present here.

What a listing does establish is narrow: a named group has chosen to associate a business name with a threat of publication. What it does not establish is theft, scope, accuracy of any data description, or confirmation by Westside GI.

What to do now

Because this remains an unconfirmed claim, steps should stay practical and conditional. If you have been a patient or employee of an ambulatory endoscopy center and are concerned that your information might appear in criminal hands, focus on habits that reduce harm whether or not this listing is genuine.

• If you receive unexpected bills, insurance notices, or messages that cite Westside GI or a related procedure, verify them through official channels you already trust—not links or phone numbers in the message.
• Watch credit and insurance explanation-of-benefits statements for accounts or services you do not recognize; dispute errors promptly with the insurer and major credit bureaus if needed.
• Use unique passwords and multi-factor authentication on email and patient-portal accounts so a leaked password elsewhere is less useful.
• Treat unsolicited “breach support” calls or texts as high-risk phishing until proven otherwise.
• If the organization later issues a confirmed notice, follow its instructions and any official regulator guidance rather than leak-site posts.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets unrelated to this claim. A clean result does not disprove a new incident; a hit on older breaches is still a reason to tighten credentials. Stay with primary sources: any statement from Westside GI, and official notices if they come. Until then, Pear’s listing is a claim—not a verified inventory of your records.

AICompiled with AI assistance from public sources and published under our editorial standards.