Tri-Century Eye Care Listed by pear Ransomware Group

On September 3, 2025, the pear Ransomware Group added Tri-Century Eye Care to its public leak site, claiming that internal files had been exfiltrated from the ophthalmology practice that serves patients of all ages across multiple locations.

What's Publicly Reported from Reporting

Public reporting indicates the incident is a ransomware attack in which the threat actors gained access to Tri-Century Eye Care’s systems, copied sensitive internal documents, and later listed the organization on their dark-web portal. The leak site, hosted at an onion address tracked by ransomware.live, shows the company’s name but does not publicly display sample data or specify the exact number of patient records involved. Available reporting describes the exposed material as internal files; no Reported Details have surfaced about the precise volume or types of personal information, though medical practices of this kind routinely hold names, dates of birth, Social Security numbers, insurance details, medical histories, and contact information for both patients and staff.

The listing appeared on September 3, 2025. At the time of publication, the group had not posted a public deadline for payment, though ransomware operators commonly issue extortion demands within days or weeks of listing a victim.

Why This Matters for You and Your Family

When a medical provider’s systems are breached, the information stolen is among the most sensitive data many families possess. A single record can contain everything needed to open fraudulent accounts, file fake tax returns, or impersonate you at other healthcare providers. For families with children, the exposure can include pediatric records that remain valuable to identity thieves for decades because minors’ credit histories are rarely monitored. Even if you have never heard of Tri-Century Eye Care, the reality is that patient data frequently travels: referrals, insurance claims, and shared electronic health record systems mean one breach can affect people who never set foot in the practice.

The Doxxing and Identity-Chain Implications

Stolen medical files rarely remain isolated. Threat actors routinely combine them with credential leaks from other breaches to build detailed identity profiles. An email address found in the Tri-Century files can be matched against gaming accounts, social-media handles, or school portals. This linking process turns a single breach into a chain that can lead to doxxing, targeted phishing, or even physical stalking when addresses, phone numbers, and family relationships are mapped together. Credential leaks like this one frequently cascade into account takeovers precisely because the same passwords or recovery details are reused across personal and family services, including children’s gaming accounts that often contain chat logs, voice data, and linked parent information.

Pear Ransomware Group’s Known Track Record

Public reporting attributes the pear Ransomware Group with emerging in late 2024. The group has claimed responsibility for attacks on healthcare providers, professional service firms, and small-to-medium businesses. Its publicly observed playbook follows a familiar pattern: initial access through phishing or exploited remote desktop credentials, exfiltration of internal documents before encryption, and dual extortion that combines data leak threats with demands for ransom payment. Notable prior victims listed on the same leak site include other medical practices and regional service companies, though exact details remain limited by the group’s selective disclosure. Researchers tracking ransomware.live note that pear typically posts victim names within days of exfiltration and escalates pressure by threatening to release samples if payment is not received.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Tri-Century Eye Care breach.
• Rotate any password you ever used at Tri-Century Eye Care or similar medical portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts where credential leaks commonly lead to takeovers and doxxing chains.
• Let remediation specialists handle the repetitive work of sending takedown requests to data brokers and monitoring the dark-web marketplaces where this information is likely to appear.

The most effective defense is to treat every new breach listing as a prompt to close the gaps attackers exploit. By mapping your full identity chain and maintaining active monitoring, you limit how far a single medical-provider incident can reach. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the loop before the next wave of extortion begins.