Neiman & Company Ransomware Claim by pear (Nov 2026)

Claim Summary

On or around November 2, 2026, a ransomware group operating under the name “pear” purportedly added Neiman & Company, Inc. (neimanandco.com) to its dark web leak site. The listing allegedly identifies the organization as a US-based financial services firm and claims to have exfiltrated data. The group has not disclosed a data volume, and no sample files, proof-of-compromise artifacts, or negotiation details have been publicly confirmed.

According to the threat actor, the claimed data relates to architectural signage work for clients including hotels, corporate offices, universities, hospitals, and museums across Southern California and beyond. This description is unusual for a financial services victim and may indicate the group has mischaracterized the target, scraped public marketing content, or simply copied language from the victim’s own website. Yazoul Security has not independently verified any element of this claim.

Threat Actor Profile

The group self-identifies as pear. At the time of writing, pear has no established public research footprint. Its total known victim count is unknown, its tooling is undocumented, and no credible YARA rules, TTP write-ups, or malware family attributions are available from public sources.

Because of this absence of track record, pear’s credibility should be treated as low to unverified. New or rebranded leak site operators frequently post exaggerated or recycled claims to build notoriety, pressure victims into paying, and attract affiliates. The lack of disclosed data volume, absence of proof samples, and vague data description are all consistent with either an opportunistic low-capability actor or a copycat listing. Analysts should not assume pear possesses the data it claims.

No detection guidance specific to pear is currently available. Standard ransomware hygiene remains advisable: monitor for unusual data staging, large outbound transfers, and unauthorized access to file shares.

Alleged Data Exposure

The group claims to hold data but has not stated a volume, format, or category. The purported description references client project information tied to signage installations. If accurate, this could include client names, project scopes, site addresses, and contact details for hospitality, healthcare, education, and corporate clients.

This remains unconfirmed. The description reads more like marketing copy than a technical data inventory, which raises questions about whether any actual exfiltration occurred. No files, screenshots, or directory listings have been observed.

Potential Impact

If the claim is genuine, downstream clients of Neiman & Company could face exposure of project and contact information, which may enable targeted phishing or business email compromise. Financial services victims may also face regulatory notification obligations depending on the data involved.

If the claim is false or inflated, the primary harm is reputational: public leak site listings are indexed and can damage trust even when unsubstantiated. Organizations named in such listings should coordinate with counsel and incident response before making public statements.

What to Watch For

• Any follow-up posts by pear containing data samples or proof files.
• Direct contact from the group to the victim or its clients.
• Unusual inbound phishing referencing signage projects or client names.
• Whether pear reuses language or branding from known groups, suggesting a rebrand.
• Independent confirmation from Neiman & Company or its representatives.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Nothing here has been independently confirmed. Yazoul Security has not validated the breach, the data, the data volume, or the group’s identity. Ransomware operators routinely exaggerate or fabricate claims. Treat all details as allegations until corroborated by the victim or a trusted third party. For related coverage, see our intel and advisory sections.