VULNpocalypse
LowBreach / campaignMonitoring

pear ransomware group claims gWorks on its leak site, RansomLook reports

RansomLook reports the pear ransomware group lists gWorks on its leak site; gWorks has not confirmed, so watch for an official statement.

Published
Exploitation
No, not confirmed: the only source is a leak-site listing recorded by RansomLook, with no independent verification

What happened

According to a RansomLook entry dated 2026-11-04, the pear ransomware group lists gWorks on its leak site (RansomLook). This is the group’s claim as recorded by a claim tracker. The listing is not proof of an attack.

Only the headline could be reviewed. The full RansomLook entry was not readable, so this advisory adds no detail beyond it.

The following points are not confirmed:

  • Whether gWorks has confirmed any incident. No source here says it has.
  • Whether any data was taken, and if so what kind or how much.
  • How attackers got in, if they did.
  • Whether any independent outlet has verified the claim. None has been found.

Am I affected?

Not confirmed. The sources do not say which systems, customers or data might be involved, if any. If you are a gWorks customer or partner, nothing in the available sources tells you that your data is affected.

What to do now

  1. Treat the listing as an unverified claim from the group.
  2. Watch for an official statement or notification from gWorks.
  3. Check back for updates. This advisory will be revised if a primary or independent source reports more.

Sources