Poe's Accounting Services Listed by pear Ransomware Group

On November 13, 2025, Poe's Accounting Services appeared on the leak site of the pear ransomware group. The firm, which provides accounting and tax return preparation, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of affected clients remains unknown, anyone whose tax documents, financial records, or personal information passed through the business is now at elevated risk of identity theft and doxxing.

What's Publicly Reported from Reporting

Public reporting indicates that pear actors listed Poe's Accounting Services on their dark web leak site on November 13, 2025. The posted material consists of internal files exfiltrated after the group deployed ransomware. No precise victim count has been released, and the full scope of exposed data has not been independently verified. The breach involves an accounting firm handling tax returns and financial documents for individuals and families, typical targets that contain Social Security numbers, addresses, income details, and banking information.

Why This Matters for You and Your Family

When an accounting or tax-preparation firm is breached, the data exposed is among the most sensitive you entrust to any business. A single tax return can contain everything needed to file fraudulent returns, open accounts in your name, or impersonate you with government agencies. For families, the exposure often includes information on spouses, dependents, and sometimes even children's records. Once that data reaches criminal marketplaces, it rarely stays contained. Credential leaks of this kind frequently cascade into gaming account takeovers, especially for households where family members reuse passwords or security questions derived from personal documents.

The Doxxing and Identity-Chain Implications

Tax and accounting data form a powerful starting point for identity-chain attacks. Criminals combine the exposed files with information already circulating from previous breaches to link email addresses, phone numbers, usernames, and real-world identities. What begins as a stolen tax document can lead to doxxing campaigns that reveal home addresses, family member names, and even children's online profiles. Gaming accounts are particularly vulnerable in these chains because kids and teens often use family email addresses or answers to security questions that appear in tax filings. Available reporting describes how such interconnected leaks allow attackers to move from one platform to another with increasing precision.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed data.
• Rotate any password you used at Poe's Accounting Services or any related tax portal anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts.

The incident underscores a simple reality: your family's most sensitive financial and personal records are only as safe as the vendors you choose. A forward-looking approach means treating every breach as a signal to tighten connections between your online handles and real identity before criminals complete the chain. DoxxScan by GalaxyWarden delivers exactly that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts.