Phillips Feldman Group Listed by pear Ransomware Group

On September 15, 2025, the pear Ransomware Group added the Phillips Feldman Group to its public leak site, claiming that internal files had been exfiltrated from the South Florida financial advisory firm during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the Phillips Feldman Group provides personalized financial guidance to individuals and businesses in South Florida. The firm’s data first appeared on the pear leak site hosted at an onion address tracked by ransomware.live. Available reporting describes the incident as a ransomware attack in which attackers exfiltrated internal files before threatening to publish them. No exact victim count or list of specific documents has been publicly detailed. The listing carries a deadline typical of ransomware groups, after which the stolen material is expected to be released or sold if demands are not met.

Why This Matters for You and Your Family

When a financial advisory firm like Phillips Feldman is breached, the personal and financial details of ordinary clients can be exposed. Tax records, account numbers, Social Security numbers, addresses, and correspondence that tie your money to your identity often sit in those internal files. Once leaked, this information does not disappear. It circulates among criminals who combine it with other stolen data to open accounts, file fraudulent taxes, or impersonate you. Your family’s financial stability and credit can be damaged long after the initial breach is forgotten.

The Doxxing and Identity-Chain Implications

Credential leaks from financial firms frequently cascade into account takeovers elsewhere. An email and password pair taken from one service is tested against banks, email providers, and gaming platforms. Children’s gaming accounts are especially vulnerable because parents often reuse credentials or link them to a family address. Once a single handle is connected to your real name and location, attackers can map an entire identity chain that leads to doxxing, harassment, or targeted scams. These chains grow faster when financial data provides the initial anchor.

Pear Ransomware Group’s Known Track Record

Public reporting attributes the pear Ransomware Group with a series of attacks on mid-sized businesses since it emerged in early 2024. The group typically gains initial access through phishing or exploited remote desktop credentials, exfiltrates data before encrypting systems, and then posts samples on its leak site to pressure victims. Its playbook relies on double extortion: demanding payment to prevent both system restoration and public release of stolen files. Notable prior victims have included other professional services firms whose client records were later published when negotiations failed.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what this claimed breach connects to.
• Rotate the password used at Phillips Feldman Group anywhere it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that includes dependents and children’s gaming accounts that often chain back to the same credentials or address.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident shows that even trusted local financial firms can become targets, and the data they hold travels quickly once it leaves their control. Starting with clear visibility into your own exposure is the most practical step you can take today. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links online handles to real identities, and hands-on remediation by specialists who manage takedowns for the entire household, including children’s gaming accounts. One short forward-looking takeaway remains: the breach that has already happened cannot be undone, but the next one can be caught and contained before it reaches your family.