South Plains Rural Health Services, Inc. Listed by pear Ransomware Group

On July 15, 2026, South Plains Rural Health Services, Inc. appeared on the leak site operated by the pear Ransomware Group. The West Texas provider of comprehensive and family care was listed after a ransomware attack in which internal files were exfiltrated. The disclosure does not quantify how many patients or employees are affected, nor does it list the specific data types beyond confirming that internal files were taken.

Confirmed Details from the Listing

The pear leak site states that South Plains Rural Health Services suffered a ransomware incident and that attackers successfully exfiltrated internal files. No patient record count is published, no ransom amount is shown, and no sample data has been posted as of the listing date. The notification simply confirms the organization was hit and that exfiltrated material is now held by the group. Public tracking services such as ransomware.live mirror this exact entry, reinforcing that the primary disclosure originates directly from the threat actor’s site.

Internal files exfiltrated is the only description given; the listing does not detail whether electronic health records, billing information, employee data, or donor records were included. This lack of specificity is common on initial leak-site postings, where operators often withhold full inventories until later negotiation stages or full data dumps.

Why This Matters for You and Your Family

If you or your family have received care at South Plains Rural Health Services, your personal health information may now sit in an attacker’s archive. Rural health clinics serve tight-knit communities where a single address or phone number can identify dozens of relatives. Even without an exact patient count, the exposure of internal files creates concrete risk: appointment histories, insurance details, Social Security numbers used for billing, and correspondence that often contain family member names and dates of birth.

Health data carries longer-lasting consequences than most other breaches. It cannot be changed like a password and can be used for insurance fraud, prescription scams, or targeted phishing that references real medical conditions. For families in West Texas, the breach may also expose children’s records, school-related health forms, or vaccination data that attackers can chain with other leaks to build detailed profiles.

The Doxxing and Identity-Chain Implications

Exfiltrated internal files frequently contain spreadsheets that link patient names to addresses, phone numbers, email accounts, and sometimes driver’s license copies. Once attackers or subsequent buyers possess these connections, they can map an individual’s digital footprint across dozens of platforms. A single email from a billing record can unlock forum accounts, shopping profiles, and gaming logins used by other household members.

Credential leaks like this one cascade into account takeovers and doxxing chains. Gaming accounts belonging to children are especially vulnerable because parents often reuse passwords or security questions derived from family medical or address history. The result is a widening web of exposed identities that can lead to harassment, SIM-swapping, or fraudulent loan applications months after the initial breach.

Pear Ransomware Group’s Known Track Record

Public reporting attributes pear as a relatively new ransomware operation that emerged in late 2025. The group follows a double-extortion model: encrypt victim systems, exfiltrate documents before encryption, then threaten both data publication and further extortion against partners or patients. Notable prior victims include other small-to-mid-size healthcare providers and municipal organizations, many in rural areas where IT resources are limited. Their typical playbook begins with phishing or exploited remote desktop credentials, followed by rapid lateral movement to file servers and exfiltration via common cloud storage services. pear’s leak site is used both to pressure victims into payment and to auction unsold data to other criminals.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have appeared in the South Plains Rural Health Services internal files.
• Rotate any password you have reused at the clinic’s patient portal or billing site, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure tied to your identity is caught and acted on within hours.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email found in medical billing records.
• Let DoxxScan remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require months of individual effort.

The pear listing of South Plains Rural Health Services underscores how quickly rural healthcare data can move from protected clinic servers to public extortion marketplaces. Acting promptly limits how far attackers and downstream buyers can travel down the identity chain. Start your DoxxScan trial today and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—work on your behalf.