Surge in Ransomware Attacks: Pear and Akira Target High-Profile Firms

Ransomware attacks are escalating in frequency and sophistication, leaving businesses and legal firms vulnerable to severe data breaches and operational disruptions. Recent intelligence from ThreatMon’s Threat Intelligence Team highlights two new victims of major ransomware groups: Gerson & Schwartz Accident & Injury Lawyers and Montage Marketing Services. These incidents underscore a troubling trend in cybercrime, where attackers exploit weaknesses in corporate and legal infrastructures to demand ransoms and access sensitive data.

Recent Ransomware Incidents

On November 3, 2025, the ransomware group Pear reportedly targeted Gerson & Schwartz Accident & Injury Lawyers, a legal firm specializing in personal injury cases. The breach was detected and documented by ThreatMon’s Threat Intelligence Team, which tracks Dark Web and ransomware activity. The attack highlights the growing risk for law firms, which handle highly confidential client data, including legal documents, case strategies, and financial information.

Later the same day, another ransomware group, Akira, attacked Montage Marketing Services, a marketing and advertising company. This demonstrates that ransomware groups are diversifying their targets, affecting industries beyond finance and healthcare. Both incidents are part of a broader surge in cybercriminal activity observed in late 2025, reflecting the increasing capability and audacity of ransomware operators.

Ransomware attacks like these typically involve encrypting a victim’s digital assets and demanding a payment in cryptocurrency in exchange for decryption keys. Beyond immediate financial demands, these breaches often compromise sensitive data, damage corporate reputation, and trigger regulatory and legal challenges.

The attacks by Pear and Akira also indicate a shift in cybercriminal behavior toward public visibility. Posting victim lists on the Dark Web or social media channels serves as a warning to other potential targets, heightening psychological pressure while showcasing the attackers’ influence and technical sophistication.

Legal and marketing firms face unique vulnerabilities due to the combination of high-value data and often underfunded cybersecurity infrastructure. While large enterprises may invest heavily in proactive defenses, smaller firms are increasingly appealing targets for ransomware actors due to gaps in network monitoring, outdated software, and insufficient employee cybersecurity training.

Another concerning aspect of these attacks is the speed at which ransomware groups identify and exploit new victims. Both incidents on November 3 suggest highly organized operations capable of launching simultaneous attacks across different sectors. Threat intelligence teams, such as ThreatMon, play a crucial role in alerting affected parties and mitigating further spread, but the reactive nature of these defenses often leaves companies scrambling to respond after the breach has already occurred.

Experts also note that ransomware activity on the Dark Web often correlates with wider criminal networks, suggesting that these incidents are not isolated events but part of a coordinated effort to monetize cybercrime on a global scale. Victims face not only financial extortion but also potential exposure of confidential client data, intellectual property theft, and long-term reputational harm.

The rise of ransomware highlights the critical need for organizations to adopt a layered cybersecurity strategy. This includes real-time threat monitoring, regular system backups, employee education on phishing threats, and robust incident response planning. Legal and marketing firms, in particular, must consider proactive measures to secure sensitive client data, as the consequences of a breach extend far beyond immediate financial loss.

What Undercode Say:

The attacks by Pear and Akira reflect a wider evolution in ransomware tactics. Unlike earlier ransomware campaigns that often focused on quantity over quality, modern attacks target organizations with high-value data and limited preparedness. Law firms, such as Gerson & Schwartz, are particularly vulnerable due to the sensitive nature of their client information, which can include personal injury cases, settlements, and confidential medical records. The potential exposure of this information can have long-lasting legal and reputational ramifications.

Marketing companies, exemplified by Montage Marketing Services, are also attractive targets because they manage proprietary campaigns, client databases, and intellectual property. Breaches here can undermine client trust, affect brand reputation, and even trigger regulatory scrutiny depending on the nature of the stolen data.

The simultaneous targeting of different industries indicates a strategic approach by ransomware operators: diversify victims to maximize payout potential and complicate law enforcement tracing efforts. Both Pear and Akira appear to operate with high technical capability, likely leveraging automated systems for scanning vulnerabilities, deploying malware, and communicating demands via the Dark Web.

These attacks also underscore a psychological dimension of cybercrime. Publicizing victims amplifies fear, coercing companies to comply with ransom demands and signaling to competitors that no organization is immune. This tactic pressures firms to act quickly, sometimes prioritizing immediate resolution over long-term security improvements, which perpetuates vulnerability cycles.

From an industry perspective, these breaches highlight critical lessons. Firms must prioritize proactive cybersecurity investments, including endpoint protection, multi-factor authentication, and continuous monitoring. Beyond technology, fostering a culture of security awareness among employees is essential. Human error remains a primary entry point for ransomware, and ongoing training can dramatically reduce risk exposure.

Additionally, the reliance on cyber insurance and legal remedies is becoming increasingly common. Companies are navigating a complex landscape where paying ransom may not guarantee data recovery, while refusing may incur financial and operational setbacks. Strategic incident response plans, which include collaboration with cybersecurity experts and law enforcement, are crucial for minimizing damage and ensuring regulatory compliance.

These incidents also reflect broader trends in cybercrime economics. Ransomware has shifted from opportunistic attacks to a more structured, profit-driven ecosystem with affiliates, negotiation strategies, and market intelligence. Monitoring the Dark Web and understanding threat actor behaviors is no longer optional—it is essential for survival in today’s digital landscape.

Finally, these attacks are a reminder that cybersecurity is a continuous process, not a one-time fix. Firms that view digital security as an ongoing investment, rather than an afterthought, are far more resilient against increasingly sophisticated ransomware threats.

Fact Checker Results:

✅ Pear ransomware targeted Gerson & Schwartz Accident & Injury Lawyers on November 3, 2025.
✅ Akira ransomware attacked Montage Marketing Services the same day.
❌ There is no evidence that either company has publicly disclosed paying ransom at this stage.

Prediction:

💥 Expect ransomware groups like Pear and Akira to expand their campaigns across multiple sectors, exploiting under-protected mid-sized firms.
🔐 Law and marketing firms will likely increase investments in real-time monitoring, secure backups, and employee cybersecurity training.
⚠️ Public exposure of victims on the Dark Web may drive more companies to adopt preemptive incident response strategies to avoid becoming the next target.

If you want, I can also make a more visually engaging version of this article suitable for a cybersecurity blog, with bolded subheadings, bullet points, and key takeaways for faster reader digestion. Do you want me to do that?