National Health Fund Listed by pear Ransomware Group

On June 2, 2026, the National Health Fund appeared on the leak site of the pear ransomware group. Internal files were exfiltrated during a ransomware attack, and the organization now faces a public deadline for negotiation or further data release.

Confirmed Details from Reporting

Public reporting indicates the National Health Fund was listed on the pear ransomware group's leak portal. The entry shows that attackers successfully exfiltrated internal files. Available reporting describes the incident as a classic ransomware double-extortion case in which data is stolen before encryption or system lockdown occurs. Exact victim numbers remain undisclosed, and the specific types of records exposed have not been detailed beyond the broad category of internal files. The listing carries an implicit negotiation deadline typical of the group’s playbook.

Why This Matters for You and Your Family

Health-related organizations hold some of the most sensitive information about ordinary people: names, addresses, dates of birth, Social Security numbers, medical histories, insurance details, and sometimes bank information for payments or reimbursements. When these records appear in a ransomware leak, anyone whose data was stored by the National Health Fund could face identity theft, insurance fraud, or targeted scams. Medical data is especially damaging because it can be used to impersonate you with doctors, file false claims, or pressure you with embarrassing personal details. Your family members, including children, may be listed in the same files, multiplying the risk across the household.

The Doxxing and Identity-Chain Risk

Stolen internal files often contain email addresses, usernames, phone numbers, and references to other accounts. Attackers and opportunistic criminals combine this information with data from previous breaches to build detailed profiles. A single leaked work email can lead to gaming accounts, social-media handles, and family photos. Credential leaks like this one frequently cascade into account takeovers, especially for gaming platforms where children use simple passwords or reused credentials. Once a chain is established, doxxing escalates quickly from leaked health records to full personal exposure.

Pear Ransomware Group's Known Activity

Public reporting attributes the pear ransomware group with operations that emerged in recent years. The group has targeted organizations across multiple sectors, using an initial-access playbook that typically relies on compromised credentials or exploitable remote services. After gaining entry they exfiltrate data before deploying ransomware. Their extortion style follows a standard double-extortion model: encrypt systems and threaten to publish stolen files unless a ransom is paid by the posted deadline. Notable prior victims listed on their leak site include entities from healthcare, education, and local government, though exact details vary by report.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist from this breach.
• Rotate any password you used at the National Health Fund or related health portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the entire household with DoxxScan family protection that includes dependents and children's gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data-broker sites or underground forums.

The incident shows that even organizations we trust with our most private information can be compromised with little warning. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts. Starting protective measures promptly gives you and your family the best chance of staying ahead of the next wave of exploitation.