gWorks Data Breach

Pear ransomware listed gWorks — a US-based government technology and software services company — on its dark web portal on November 4, 2026. The listing was identified via SOCRadar’s Dark Web Monitoring service. gWorks provides software platforms and technology solutions serving local government and public sector clients across the United States, which makes a potential breach significant beyond the company itself, given the downstream exposure of the public-sector client base that depends on its platforms. Pear claimed 15 victims in the 60 days prior to this listing. Healthcare, Retail & E-Commerce, and Technology are its primary sectors, and its victims are overwhelmingly concentrated in the United States. Recent listings include Palm Vascular Centers, Neiman & Company Inc., Five Star Jewelers, and Cyrious Software. gWorks’ public-sector focus makes it a slightly atypical target within pear’s US tech cluster, though the sector boundary is thin, and the group’s concentration in the United States aligns directly with gWorks’ operating footprint.

SOCRadar’s stealer-log telemetry returned no records for the gworks.com domain, and no credentials surfaced in this query slice. However, this absence of records does not confirm that the organization is unaffected. Credentials may have surfaced outside this dataset, through alternate subdomains or partner portals, or under personal email aliases, and data may not yet have been indexed. Pear’s standard access pathway uses infostealer-harvested credentials to authenticate against VPN or M365 portals before deploying ransomware. While the telemetry result does not confirm that this exact access method was used in this case, the pattern indicates how credential exposure can support initial access: harvested credentials may be validated by operators or access brokers and then used against corporate accounts, VPNs, or remote-access portals to facilitate ransomware deployment. The lack of correlation in the queried slice therefore does not rule out compromise through these channels. gWorks is listed as a claimed victim on November 4, 2026, and the listing has not been independently verified. Organizations using gWorks platforms should monitor for anomalous activity in those systems, and credential reuse across corporate and gWorks-administered portals warrants verification. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, password rotation, multi-factor authentication review, and monitoring of alternate corporate domains, Microsoft 365, VPN, and remote-access activity remain prudent. The public-sector client base adds downstream risk beyond the company itself, and this listing should be kept under review as more information becomes available.