Monmouth University and Lehigh Carbon Community College: Cybercriminal group says it hacked Monmouth University, stole data

PEAR Ransomware Group Claims 16TB Data Theft from Monmouth University

A ransomware group known as PEAR (Pure Extraction and Ransom) has taken responsibility for a cyberattack on Monmouth University, a private institution in New Jersey, earlier this month. The group alleges it stole 16 terabytes of data and posted sample documents as proof, though the university has not confirmed the claim, and the specifics of the compromised data remain unverified.

In a statement to students, Monmouth University President Patrick Leahy acknowledged an "unauthorized access" incident but assured that operations remained unaffected. The university activated its response protocols, engaged cybersecurity experts, and notified the FBI and Department of Education, though the full investigation may take weeks. While containment efforts are underway, the university is working to identify affected individuals for notification.

Unlike traditional ransomware groups, PEAR specializes in data theft and extortion rather than encryption. Since its emergence in August 2025, the group has claimed 64 attacks, with 13 confirmed, including breaches at Motility Software Solutions (766,670 individuals affected), Tri-Century Eye Care (200,000), and Brevard Skin and Cancer Center (55,000). PEAR’s tactics involve threatening to leak or sell stolen data if ransoms go unpaid.

Monmouth University joins a growing list of 2026 education sector targets, with six confirmed ransomware attacks on U.S. schools and universities this year, including Denmark School District (WI), Wagon Mound Public Schools (NM), and Lehigh Carbon Community College (PA). The rise in such incidents highlights the sector’s vulnerability to data breaches and operational disruptions.

Monmouth University enrolls over 6,000 students and employs 300 full-time faculty, though the full scope of the breach’s impact remains under investigation.

Source: https://www.comparitech.com/news/cybercriminal-group-says-it-hacked-monmouth-university-stole-data/

Monmouth College cybersecurity rating report: https://www.rankiteo.com/company/monmouth-college

Lehigh University cybersecurity rating report: https://www.rankiteo.com/company/lehigh-university

"id": "MONLEH1774537045",
"linkid": "monmouth-college, lehigh-university",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Education',
                        'location': 'New Jersey, USA',
                        'name': 'Monmouth University',
                        'size': '6,000 students, 300 full-time faculty',
                        'type': 'University'}],
 'customer_advisories': 'Statement to students from President Patrick Leahy',
 'data_breach': {'data_encryption': 'No (PEAR specializes in data theft, not '
                                    'encryption)',
                 'data_exfiltration': 'Yes (16TB alleged)'},
 'description': 'A ransomware group known as PEAR (Pure Extraction and Ransom) '
                'has taken responsibility for a cyberattack on Monmouth '
                'University, a private institution in New Jersey, earlier this '
                'month. The group alleges it stole 16 terabytes of data and '
                'posted sample documents as proof, though the university has '
                'not confirmed the claim, and the specifics of the compromised '
                'data remain unverified.',
 'impact': {'data_compromised': '16TB',
            'operational_impact': 'Unaffected (per university statement)'},
 'initial_access_broker': {'data_sold_on_dark_web': 'Threatened (if ransom '
                                                    'unpaid)'},
 'investigation_status': 'Ongoing (may take weeks)',
 'motivation': 'Data theft and extortion',
 'ransomware': {'data_encryption': 'No',
                'data_exfiltration': 'Yes',
                'ransomware_strain': 'PEAR (Pure Extraction and Ransom)'},
 'references': [{'source': 'Cyber incident report'}],
 'regulatory_compliance': {'regulatory_notifications': 'FBI and Department of '
                                                       'Education notified'},
 'response': {'communication_strategy': 'Statement to students from President '
                                        'Patrick Leahy',
              'containment_measures': 'Underway',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'FBI and Department of Education',
              'third_party_assistance': 'Cybersecurity experts'},
 'threat_actor': 'PEAR (Pure Extraction and Ransom)',
 'title': 'PEAR Ransomware Group Claims 16TB Data Theft from Monmouth '
          'University',
 'type': 'Ransomware'}