A data extortion group called Pear has claimed on its leak site that it attacked Indroj Medical Group, a California internal medicine practice. Indroj Medical Group has not confirmed a data breach, and no patient notice has been found.
What Pear Has Claimed About Indroj Medical Group
Indroj Medical Group, Inc. is an internal medicine practice in Yucca Valley, California, in San Bernardino County. A regional provider directory also lists an Indroj Medical Group office in Rancho Mirage.
On September 24, 2026, ransomware tracking services recorded a new listing for “Indroj Medical Group Inc.” on Pear’s leak site. A leak site is a website where criminal groups name the organizations they say they attacked, often to pressure them into paying.
This listing is a claim made by a criminal group. Indroj Medical Group has not confirmed it. No news outlet or regulator has described what, if anything, the group took.
What Indroj Medical Group Has Said So Far
As of October 20, 2026, Emery | Reddy has not found any public statement from Indroj Medical Group about a cyber incident. The firm also has not found a notice letter, a California Attorney General filing or a listing on the federal HHS breach portal. HHS is the U.S. Department of Health and Human Services, which posts health data breaches that affect 500 or more people.
That means three key questions remain open:
- Whether a data breach actually occurred
- Whether any patient or employee information was involved
- How many people, if any, may be affected
Indroj Medical Group has not disclosed any remedy, such as free credit monitoring. No lawsuit related to this claim has been found.
Who Is the Pear Group?
Pear is also known as PEAR, short for “Pure Extraction and Ransom.” WatchGuard’s ransomware tracker reports that the group was first seen in June 2025. Ransomware is malicious software or hacking that locks or steals an organization’s files so criminals can demand payment.
According to Paubox, a healthcare email security company, Pear’s attacks focus on stealing data and then threatening to publish it. Paubox reported that the group mainly targets healthcare, business services, manufacturing and technology.
A leak-site claim does not prove that data was taken. Still, a claim like this one is often the first public sign of an incident. Formal notice letters, when they come, can follow weeks or months later.
What Records Does a Medical Practice Usually Keep?
Indroj Medical Group has not said what information, if any, was involved. In general, medical practices like this one often hold records such as:
- Patient names, addresses and dates of birth
- Health insurance and billing details
- Medical history, diagnoses and treatment notes
- Employee and payroll records
This list describes what medical offices typically keep. It is not a list of data involved in this incident.
Steps Patients Can Take Now
Until Indroj Medical Group says more, patients and former patients can take simple steps to protect themselves:
- Watch the mail for a Notice of Data Breach letter and keep it if one arrives
- Review health insurance statements and Explanation of Benefits forms for care never received
- Check bank and card statements for charges that look unfamiliar
- Consider a free credit freeze with Equifax, Experian and TransUnion
- Be careful with emails, texts or calls that mention Indroj Medical Group or a cyber attack
Do You Have Legal Options?
Healthcare providers that collect patient information have a legal duty to protect it and to tell patients when it has been compromised. If Indroj Medical Group confirms that patient information was involved, affected individuals may have legal rights and remedies.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.
FAQ
Has Indroj Medical Group confirmed a data breach?
No. As of October 20, 2026, Indroj Medical Group has not confirmed a data breach or made a public statement. The Pear group claimed the attack on its leak site, and that claim remains unconfirmed.
How many people were affected?
No one knows yet. Indroj Medical Group has not reported any number, and no government filing has been found. Pear has not stated a number either.
Was my information involved?
That is not known. Indroj Medical Group has not said whether any patient or employee information was involved. If it confirms a breach, it may send notice letters to the people affected.
What is a leak site?
A leak site is a website run by a criminal group. The group lists organizations it says it attacked, and sometimes posts files, to pressure them into paying. A listing is a claim, not proof.
What should I do if I worked for, bought from, or was a patient of Indroj Medical Group?
- Keep any letter or email you receive from Indroj Medical Group about a cyber incident
- Review insurance, bank and card statements for activity you do not recognize
- Consider a credit freeze, which is free
- Do not click links in messages that mention the incident; contact the sender through a phone number you trust
- Request a Free Case Review to learn about your options
How can I protect myself from scams that mention a cyber attack?
Criminals sometimes use news of an attack to send fake messages. They may pose as a doctor’s office, an insurer or a bank. Be wary of any message that asks for passwords, payment or personal details. Call the organization directly using a number from its official website or your own records.
Do I have a legal claim?
It is too early to know. Healthcare providers have a duty to protect patient information and to give timely notice when it is compromised. If Indroj Medical Group confirms that your information was involved, you may have rights. Emery | Reddy is investigating. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.
