Palm Vascular Centers Data Breach

Pear ransomware listed Palm Vascular Centers — a US-based vascular medicine provider — on its dark web portal on November 4, 2026. The listing was identified via SOCRadar’s Dark Web Monitoring service. Palm Vascular Centers specializes in minimally invasive vascular procedures, and healthcare organizations of this profile hold patient records, insurance data, and clinical information — material with significant resale and extortion value, which may explain why the sector remains a recurring target for ransomware and extortion activity. Pear has claimed 15 victims in the 60 days prior to this listing, with Healthcare among its top three targeted sectors alongside Retail & E-Commerce and Technology. Its victims are concentrated overwhelmingly in the United States. Prior US healthcare listings include Indroj Medical Group Inc. and Westside GI. Palm Vascular Centers fits that established pattern of small to mid-sized American healthcare providers, matching pear’s typical targeting profile both geographically and by sector.

SOCRadar’s stealer-log telemetry returned no records for the palmvascular.com domain. However, healthcare staff frequently access clinical portals and partner systems outside a primary corporate domain, and those access points would not appear in this query. The null result narrows nothing: it does not confirm that the organization is unaffected, and the absence of evidence is not evidence that no compromise occurred. Credential-based initial access via VPN or Microsoft 365 remains the standard pear pathway. Infostealer-harvested credentials are commonly brokered or validated in underground marketplaces before being used to access corporate accounts, VPNs, or remote-access portals, which may then enable ransomware deployment. This represents a possible intrusion path rather than a confirmed attack method in this case, as the listing has not been independently verified. Palm Vascular Centers is listed as a claimed victim on November 4, 2026, and US healthcare providers in pear’s geographic profile should treat this as a relevant peer event. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, password rotation, multi-factor authentication review, monitoring alternate corporate domains, and reviewing Microsoft 365, VPN, and remote-access activity are warranted to reduce exposure to credential-based attacks.