Western Orthopaedics in Denver, CO this week confirmed it notified 113,330 people of a September 2025 data breach that compromised the following personal info:
- Names
- Social Security numbers
- Financial account numbers
- Credit and debit card numbers
- Health insurance info including plans and ID numbers
- Medical providers
- Medical dates of service
- Medical costs and billing info
- Phone numbers
- Dates of birth
- Addresses
The clinic said it became aware of the breach in early October, about a week after an unauthorized third-party accessed its network and stole data.
A ransomware group called PEAR took credit for the breach at the end of September. On its data leak website, PEAR said it stole 1.7 TB of data from Western Orthopaedics. PEAR published the data on September 30, 2025, according to SuspectFile.
Western Orthopaedics has not acknowledged PEAR’s claim and Comparitech cannot independently verify it. We do not know if Western Orthopaedics paid a ransom, how much PEAR demanded, or how attackers breached the clinic’s network. Comparitech contacted Western Orthopaedics for comment and will update this article if it replies.
“On October 2, 2025, Western Ortho became aware of a potential security incident,” says the clinic’s notice (PDF) to breach victims.
“Based on the investigation, Western Ortho determined that, as part of the security incident, between approximately September 17, 2025 and September 25, 2025, an unauthorized third party accessed and/or acquired certain data contained within our network.”
Western Orthopaedics is offering breach victims free credit monitoring and identity theft protection through Epiq.
Who is PEAR?
PEAR, or Pure Extraction and Ransom, is a cybercriminal gang that steals and ransoms data. It started claiming responsibility for ransomware attacks on its data leak website in August 2025. Unlike many other ransomware groups, PEAR does not encrypt data. Instead, it focuses solely on data theft and extortion.
The group has claimed responsibility for 82 ransomware attacks in total. Of those, 16 have been confirmed by the organizations targeted. Six of those confirmed targets were healthcare providers like Western Orthopaedics. The others include:
- Expert MRI (CA) reported a June 2025 data breach
- Tri-Century Eye Care (PA) notified 200,000 people of a September 2025 data breach
- Brevard Skin and Cancer Center (FL) notified 55,000 people of a September 2025 data breach
- Medical Center (GA) reported an October 2025 data breach
- Rocky Mountain Associated Physicians (UT) notified 50,640 people of an October 2025 data breach
In 2026, PEAR has taken credit for 31 more attacks including a confirmed breach at Monmouth University.
Ransomware attacks on US healthcare
Comparitech researchers logged 139 confirmed ransomware attacks on US hospitals, clinics, and other healthcare providers in 2025. Those attacks compromised 12.3 million personal records.
In 2026 to date, we’ve tracked 14 more attacks on US healthcare. Some other recently-confirmed attack claims include:
- Tri-Cities Gastroenterology (TN) notified 67,115 people of a December 2025 data breach claimed by Insomnia
- Hematology Oncology Consultants (MI) reported a September 2025 data breach for which Rhysida demanded $557,000
- FMRS Health Systems (WV) reported a January 2026 data breach claimed by Qilin
- Mile Bluff Medical Center (WI) reported an April 2026 ransomware attack
- Sandhills Medical Foundation (SC) notified 169,017 people of a May 2025 data breach claimed by Inc
Ransomware attacks on healthcare providers can both lock down computer systems and steal data. In PEAR’s case, it’s most likely just the latter. Once infected, attackers threaten to publish stolen personal data if a ransom is not paid.
About Western Orthopaedics
Western Orthopaedics operates three orthopedic surgery clinics in Denver, Littleton, and Englewood, Colorado.
