Bridgestone HosePower LLC Data Breach

Bridgestone HosePower LLC, a manufacturing company in the United States operating in the industrial hose management space, has been listed as a victim on the dark web leak portal of the pear ransomware group as of November 5, 2026. SOCRadar Dark Web Monitoring identified the listing. The claim places the company squarely within pear’s current targeting pattern, which has repeatedly focused on US-based, mid-market industrial services organizations. Although a leak-site listing does not by itself constitute a confirmed breach, the company’s national footprint, mid-market size, and industrial services profile align closely with the type of organization the group has claimed in recent weeks, making the listing a credible and high-priority signal for the company’s security teams. pear has run a focused and consistent operation over the past 60 days, claiming 16 victims in that period, nearly all of them American. Its most frequently targeted sectors are Healthcare, Retail & E-Commerce, and Technology. Recent victims named on the group’s portal include Palm Vascular Centers (US, Healthcare), gWorks (US), Neiman & Company, Inc. (US, Financial Services), and Five Star Jewelers (US, Retail & E-Commerce). Bridgestone HosePower fits this pattern: a US-based industrial services company of the mid-market type pear has repeatedly targeted. The geographic overlap is near-total given the group’s overwhelmingly American victim base, while the company’s industrial focus adds a new vertical to pear’s recent list — but its scale and US operations are fully consistent with the group’s apparent selection criteria.

SOCRadar’s stealer-log telemetry returned 8 records for the hosepower[.]com domain, all of them tied to a single compromised corporate identity. Between January and July 2026, this Bridgestone HosePower corporate identity appeared four times in stealer-log feeds, each time logging into DocuSign’s OAuth authentication layer. Four of the eight records target DocuSign OAuth authentication endpoints — the same identity across multiple OAuth flows during the first half of 2026. The remaining records show that same employee credential reused on residential property management portals, indicating habitual cross-platform password reuse. The dominant exposure profile is workstation compromise risk, with the underlying logs spanning 2026-01-01 to 2026-07-01. None of the records hit hosepower[.]com infrastructure directly, and this result does not confirm that the organization is unaffected. Stealer-log coverage is inherently partial: credentials may exist under alternate corporate domains or personal email aliases, in feeds outside the queried dataset, or may not yet have been indexed — and the absence of evidence is not evidence that no compromise occurred. More significantly, document signing authority, identity verification, and OAuth tokens are themselves access levers. A corporate identity with persistent DocuSign access is a credible staging point for a lateral move, meaning the harvested credentials could plausibly have supported intrusion activity even without a direct hit on hosepower[.]com systems. At this stage, that remains a possible scenario consistent with the observed telemetry rather than a confirmed attack path used against Bridgestone HosePower. The exposed corporate identity should be treated as fully compromised. The immediate priorities are an audit of DocuSign access logs — specifically any OAuth tokens issued or document-signing actions taken under that identity in the January–July 2026 window — along with MFA enforcement and a credential reset across all identified third-party accounts. Because the same credential was reused on residential property management portals, resets should cover those third-party services as well, not only the corporate account. Reviewing whether the identity retains active OAuth grants and verifying that no unauthorized document-signing activity occurred during the exposure window will help determine whether the credential was ever weaponized.