Neiman & Company, Inc. Data Breach

Pear ransomware listed Neiman & Company, Inc. on its dark web leak portal on November 2, 2026, and the listing was identified through SOCRadar’s Dark Web Monitoring service. Neiman & Company is a US-based financial services firm. Pear has demonstrated a preference for small-to-mid-size US businesses across multiple sectors, and this listing fits that model, placing a financial services organization within the group’s active extortion portfolio. As with any leak-site claim, the listing should be treated as alleged rather than a confirmed breach until it can be independently verified. Pear has claimed 15 victims in the past 60 days, with its targeting focused on Retail & E-Commerce, Technology, and Healthcare, and the United States and Jamaica serving as its primary geographies. Other recent listings include Five Star Jewelers, Cyrious Software, Fresh Farms, and Caretaker Landscape and Tree Management. Neiman & Company extends pear’s reach into financial services, a sector not represented in the group’s recent victim set. The claim therefore differs from pear’s most frequently targeted industries, but the victim’s US base and small-to-mid-size profile align with the group’s demonstrated geographic and size preferences, keeping the listing consistent with pear’s broader targeting model even as it broadens the group’s sector coverage.

SOCRadar’s stealer-log telemetry — a dataset of stolen credentials harvested by information-stealing malware and traded on criminal markets — returned one record for neimanandco[.]com, dated February 22, 2026. The record pairs a corporate @neimanandco.com email address with credentials for a third-party external service. That pattern points to a workstation compromise: an employee device was likely infected, and credentials stored on it were exfiltrated. This is an observed telemetry finding and should not be read as a confirmed intrusion path for pear; it establishes that company-linked credentials are circulating in criminal datasets. No direct credentials for internal organizational systems such as VPN, Microsoft 365, or the HR portal appeared in this slice, which places the observed risk profile at the workstation level rather than direct corporate intrusion. That distinction does not neutralize the signal. Information-stealing malware infections often capture far more than what is indexed in any single query, so the absence of internal-system credentials in this result does not confirm that Neiman & Company is unaffected; records may exist in feeds outside the queried dataset or may not yet have been indexed. The exposed credential dates to February 2026, roughly nine months before this report, and there is no evidence of rotation — that window is the decision point for the organization. Because the exposed credential has remained unrotated for nine months, rotating it and running proactive credential-hygiene checks across the corporate domain should be treated as immediate priorities. Continued stealer-log and dark web monitoring is warranted to detect additional records tied to neimanandco[.]com, including any that surface for internal systems such as VPN and Microsoft 365, and reviewing authentication and remote-access activity on those platforms would help determine whether the exposure has been abused. Continued monitoring of pear’s leak portal and related credential datasets is advised to identify further developments connected to this listing.