Macfarlan Capital Partners Ransomware Claim by pear (Oct 2026)

Claim Summary

On or around October 14, 2026, a ransomware group operating under the name “pear” allegedly listed Macfarlan Capital Partners on its dark web leak site. Macfarlan Capital Partners is a US-based equity real estate investment sponsor that purportedly serves institutional investors, family offices, wealth management advisors, and high net worth individuals.

According to the threat actor’s claim, the firm was added to the group’s victim roster on the stated attack date. The group has not disclosed a data volume, sample files, or any proof-of-compromise artifacts in the information available to Yazoul Security at the time of writing. The claim remains unverified and should be treated with caution.

Threat Actor Profile

The group tracked here as pear is not well documented in public threat intelligence. Yazoul Security has no confirmed record of the group’s total victim count, and no public research references were available at the time of this report. The group’s known tooling and tactics are currently unknown.

This absence of a track record is itself a meaningful data point. Established ransomware operations such as LockBit, ALPHV, and Cl0p have extensive histories that allow analysts to assess credibility, typical encryption routines, and negotiation behavior. A group with no documented history may be:

• A newly emerged operation still establishing its reputation.
• A rebrand or spin-off of an existing group seeking to obscure attribution.
• An opportunistic actor making exaggerated or unsubstantiated claims to pressure victims.

Because no tools, malware families, or intrusion techniques have been attributed to pear, defenders cannot yet map the group to known YARA rules or detection signatures. Organizations should rely on general ransomware detection guidance - monitoring for mass file encryption, shadow copy deletion, unusual lateral movement, and exfiltration over common protocols - rather than actor-specific indicators.

Alleged Data Exposure

The leak site entry allegedly describes Macfarlan Capital Partners as an equity real estate investment sponsor serving institutional investors, family offices, wealth management advisors, and high net worth individuals. This description appears to be drawn from the firm’s own public marketing language rather than from exfiltrated internal documents.

No data volume has been disclosed. No sample files, credentials, or download links are referenced in this report, and Yazoul Security will not publish or link to any such material. Whether any data was actually exfiltrated remains entirely unconfirmed.

Potential Impact

If the claim is accurate, a financial services firm of this profile could face exposure of investor communications, fund performance data, client onboarding records, or deal-related documentation. For a sponsor serving high net worth individuals and family offices, even the perception of a breach can carry reputational and regulatory consequences.

However, ransomware groups routinely exaggerate claims, list victims prematurely, or post entries based on minimal or no actual access. The absence of disclosed data volume or proof artifacts in this case warrants particular skepticism.

What to Watch For

• Any official statement from Macfarlan Capital Partners confirming or denying the claim.
• Publication of sample data by the group, which would raise confidence in the claim.
• Regulatory filings or disclosures that reference a cybersecurity incident.
• Additional victims posted by pear, which could help establish the group’s pattern of behavior.
• Independent research from other threat intelligence vendors corroborating the group’s activity.

Yazoul Security will continue monitoring this claim and will update our advisory coverage at /advisory/ as verified information becomes available.

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Yazoul Security has NOT independently confirmed that Macfarlan Capital Partners suffered a ransomware attack, that any data was exfiltrated, or that the “pear” group is responsible for any such incident. All statements attributed to the threat actor are allegations only. Ransomware groups frequently make false, inflated, or misleading claims. Readers should not treat this listing as evidence of a confirmed breach. No personal information, credentials, data samples, or access instructions are included in this report by design.