Western Orthopaedics Suffers Massive Data Breach Affecting 113,000 Patients Western Orthopaedics, a Colorado-based orthopedic clinic with locations in Denver, Littleton, and Englewood, confirmed a September 2025 data breach exposing sensitive personal and medical information of 113,330 individuals. The compromised data includes names, Social Security numbers, financial account details, credit/debit card numbers, health insurance information, medical provider records, billing data, phone numbers, dates of birth, and addresses. The clinic detected the breach on October 2, 2025, after an unauthorized third party accessed its network between September 17 and 25. The ransomware group PEAR (Pure Extraction and Ransom) claimed responsibility, alleging it stole 1.7 TB of data and published it on September 30. Western Orthopaedics has not confirmed PEAR’s involvement, and details about ransom demands or payment remain undisclosed. As part of its response, Western Orthopaedics is offering affected individuals free credit monitoring and identity theft protection through Epiq. PEAR’s Growing Threat to Healthcare PEAR, a ransomware group active since August 2025, specializes in data theft and extortion rather than encryption. It has claimed 82 attacks, with 16 confirmed, including six targeting healthcare providers. Other recent victims include Tri-Century Eye Care (200,000 records exposed) and Brevard Skin and Cancer Center (55,000 records exposed). Ransomware’s Impact on U.S. Healthcare In 2025, 139 confirmed ransomware attacks on U.S. healthcare providers compromised 12.3 million records. So far in 2026, 14 additional attacks have been reported, with groups like Rhysida, Qilin, and Inc targeting medical organizations. Unlike traditional ransomware, PEAR’s tactic focuses solely on data theft, threatening to leak sensitive information unless a ransom is paid.