On July 15, 2025, The Job Shop, a San Francisco Bay Area staffing and recruitment firm, appeared on the leak site of the pear ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that could affect anyone who has submitted resumes, employment applications, background checks, or payroll information through the company.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch The Job Shop
Get alerted the next time The Job Shop files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about The Job Shop’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting on the pear leak site lists The Job Shop as a victim and states that internal files were taken. The exact number of people affected remains unknown. Available reporting describes the data as internal documents rather than a structured database of customer records. No specific samples of the leaked material have been independently verified beyond the group’s own posting. The incident follows the pattern of many ransomware cases in which attackers first gain access, exfiltrate files, then demand payment to prevent publication.
Why This Matters for You and Your Family
If you have ever applied for work through The Job Shop, your resume, contact details, employment history, Social Security number, or references may now sit in files controlled by attackers. The same risk applies to current or former employees whose payroll records, tax forms, or direct-deposit information were stored internally. One breach like this can supply the raw material for identity theft, loan fraud, or targeted phishing that reaches every member of your household. Children who share a parent’s email address on family job-search accounts face downstream risks as well.
The Doxxing and Identity-Chain Implications
Recruitment records frequently contain not only names and addresses but also phone numbers, email accounts, LinkedIn profiles, and references that link one identity to another. Attackers can chain these details with information from earlier breaches to build a complete picture of you and your family. A single exposed resume can reveal your spouse’s employer, your children’s schools, and gaming usernames tied to the same household email. Once mapped, these connections make it easier for criminals to impersonate you, hijack accounts, or launch doxxing campaigns that publish personal information online.