Golden Pear Funding Data Breach

Settra has listed Golden Pear Funding, a company operating in the litigation funding and legal finance sector, on its dark web leak site on October 2, 2026. The ransomware group claims to have exfiltrated corporate data, though this remains unverified. The nature of litigation funders means they possess sensitive information, including case assessments, settlement projections, plaintiff financial details, and confidential legal strategies, all of which are protected by layers of privilege and confidentiality. This makes them a high-value target for threat actors seeking leverage. The Settra group’s double extortion tactic is particularly potent against a litigation funder. The disclosed information could directly impact ongoing legal proceedings and potentially expose the funder to liability towards its clients, far beyond the typical reputational or financial damage from leaked data. This presents a stronger coercive tool for ransomware operators than the threat of exposing standard corporate data like payroll information.

SOCRadar’s investigation using stealer-log data queries for Golden Pear Funding yielded no positive results. The likely initial access vector for this incident is suspected to be phishing attacks targeting legal or financial staff, or a compromise through a partner entity such as a law firm or a legal technology provider that shares document access. Critical to note is that specialized platforms used in litigation finance, such as e-signature and secure document-sharing services, may not generate detectable stealer-log records under the funder’s primary corporate domain, thereby limiting direct visibility into such compromises. The absence of stealer-log records does not confirm that the organization is unaffected. Credentials could potentially exist under alternate or subsidiary corporate domains that were not part of the query. Furthermore, any exposed credentials may have been used and subsequently rotated by the threat actors before the data was indexed in the queried datasets. It is also possible that the compromised data has not yet been indexed in the available feeds. Given the potential for compromise, it is advised to conduct continued dark web monitoring. Proactive credential hygiene checks, including password rotation and a thorough review of multi-factor authentication (MFA) configurations for all platforms, are crucial. Organizations should also monitor activity on alternate corporate domains and review logs for Microsoft 365, VPNs, and other remote-access portals for any suspicious behavior.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.