Brevard Skin and Cancer Center over the weekend confirmed it notified 55,500 people of a September 2025 data breach that compromised the following personal info:
- Names
- Social Security numbers
- Billing and claims info
- Diagnoses and clinical info
- Phone numbers
- Home addresses
- Dates of birth
- Email addresses
Ransomware group PEAR took credit for the attack, saying it stole 1.8 TB of data.
Brevard has not verified PEAR’s claim. We do not know if Brevard paid a ransom, how much PEAR demanded or how attackers breached Brevard’s network. Comparitech contacted Brevard for comment and will update this article if it replies.
“On or around October 14, 2025, we became aware of a breach of security of certain protected health information (“PHI”) maintained in our data systems,” says Brevard’s notice to victims.
“Our investigation is on-going, but we have discovered that on or around September 28, 2025, an unauthorized third party accessed some of our data systems. Certain PHI of our patients was exfiltrated from these data systems.”
Brevard is offering eligible victims 24 months of free credit monitoring through IDX. The deadline to enroll is March 26, 2026.
Who is PEAR?
PEAR, or Pure Extraction and Ransom, is a new ransomware gang that steals and ransoms data. Unlike many other ransomware strains, it does not encrypt data. Instead, it focuses solely on data theft and extortion.
PEAR started taking credit for ransomware attacks in August 2025. Since then, it’s claimed responsibility for 50 ransomware attacks. Seven of those were publicly acknowledged by the targeted organizations.
Earlier this month, Tri-Century Eye Care in Pennsylvania also started notifying victims of another September 2025 data breach claimed by PEAR. The ophthalmologist notified more than 200,000 people of the breach.
PEAR’s biggest attack to date hit Motility Software Solutions, which notified 766,760 people of the ensuing data breach.
Ransomware attacks on US healthcare
Comparitech researchers have logged 89 confirmed ransomware attacks on US hospitals, clinics, and other direct care providers. Those attacks compromised 8.25 million records in total.
Some other such recent attacks include:
- Heywood Healthcare (MA) notified 500 people of an October 2025 data breach claimed by Sinobi
- Richmond Behavioral Health Authority (VA) notified 113,232 people of a September 2025 data breach claimed by Qilin
- Woodlawn Health (IN) notified at least 500 people of a June 2025 data breach by unknown attackers
- MedStar Health (MD) notified patients of a September 2025 data breach claimed by Rhysida
Ransomware attacks on healthcare providers can both steal data and lock down computer systems. In PEAR’s case, it’s most likely just the former. If providers don’t pay the ransom, ransomware gangs threaten to sell stolen data to cybercriminals or publish it on a public forum. That could put patients at increased risk of fraud and violate their privacy.
About Brevard Skin and Cancer Center
Brevard Skin and Cancer Center is a dermatologist with five locations in Brevard County, Florida: Merritt Island, Rockledge, Titusville, Viera, and Palm Bay.
