Clarkston First Baptist Church Listed by pear Ransomware Group

On June 26, 2025, the pear Ransomware Group added Clarkston First Baptist Church in Georgia to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack on the historic institution founded in 1881.

What's Publicly Reported from Reporting

Public reporting indicates the church’s internal documents appeared on the onion-based leak page hosted by the group. The listing states that data was stolen and will be published if the church does not meet the attackers’ demands. No exact victim count inside the church has been disclosed, and the precise volume or sensitivity of the files remains unclear from available reporting. The incident follows the typical pattern in which ransomware operators first encrypt systems, then threaten to release stolen data unless a ransom is paid.

Internal files were allegedly exfiltrated, a step that gives the attackers leverage even if backups allow the church to restore its operations. The leak site entry carries the date June 26, 2025, and links directly to the church’s name and location in Clarkston, Georgia.

Why This Matters for You and Your Family

Churches, schools, sports leagues, and community groups routinely collect and store personal information about ordinary families: addresses, phone numbers, dates of birth, Social Security numbers for staff or volunteers, donation records, and sometimes children’s activity forms. When any of those organizations suffers a breach, your family’s details can end up in the hands of criminals without your knowledge. In this case, the victim is a 144-year-old church, yet the exposure risk extends to every household whose data resided on its systems.

Credential leaks from such incidents often cascade into gaming accounts, email takeovers, and further identity theft. If your child uses an email address tied to the church youth group or sports team, that same password may protect their Roblox, Fortnite, or Discord account. Once attackers link one handle to another, the chain can lead to doxxing or targeted harassment.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at encryption. After exfiltrating files they publish samples or full datasets to pressure payment. Those files frequently contain spreadsheets that map names to addresses, phone numbers, and email accounts. Attackers then cross-reference this information with other breaches, building an identity chain that connects your church profile to your social-media handles, your children’s usernames, and ultimately your home address. The result is a road map for identity theft, spear-phishing, or physical intimidation.

Available reporting describes this exact progression in earlier incidents: stolen member lists surface on dark-web markets, passwords are tested across dozens of services, and families begin receiving credible threats. The speed at which these chains form has shortened dramatically; what once took months can now unfold in days.

Pear Ransomware Group’s Known Track Record

Public reporting attributes the pear Ransomware Group with a growing list of attacks on mid-sized organizations, including churches, local governments, and small manufacturers. The group emerged in late 2024 and follows a double-extortion playbook: it deploys ransomware to encrypt victim systems, exfiltrates sensitive files before triggering the encryption, then posts proof on its leak site with countdown timers. Typical demands begin in the low six figures and escalate if the victim does not respond. Prior victims have included community institutions whose internal records contained personal data on thousands of local residents. The group’s leak site remains active on the Tor network, where it publishes both sample documents and full download links for unpaid victims.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what the pear leak may have exposed.
• Rotate any password used at the church or any related community group anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails used for church or school forms.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with threat actors yourself.

The incident at Clarkston First Baptist Church illustrates a growing reality: data collected by the community organizations your family trusts can become ammunition for ransomware operators. Acting quickly on the credentials and records already exposed, while establishing ongoing visibility into new leaks, remains the most practical defense. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also secure gaming accounts belonging to you or your children.