gWorks

This record is a provider-reported ransomware claim attributed to pear. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector
Other
Provider-reported country
United States
Group-published claim date
First tracked
Last observed
Monitoring providers
4
Independent monitoring providers
3
Website
gworks.com
Post URL
https://www.ransomlook.io/
Data source
unified
Duplicate records merged
3

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

  1. Monitoring provider: observed ; source-published ; retrieved .
  2. Monitoring provider: observed ; source-published ; retrieved .
  3. Monitoring provider: observed ; source-published ; retrieved .
  4. Monitoring provider: observed ; source-published ; retrieved .

Provider records

Every stored provider record behind this claim, newest first.

  1. Provider credit
    RecentBreaches
    Provider URL
    https://recentbreaches.com/breach/gworks-pear-2026-11
    Feed id
    recentbreaches
    Provider record id
    derived-sha256:f570f8ac2abb636b1232c0da12983c7a05d9a444e1d4584b0dfb36c2602f915b
    Observed
    Source-published
    Retrieved
    Format
    rss
    Transport
    https-rss
    Overlap class
    mirror
    Independent corroboration
    no
  2. Provider credit
    ransomware.live
    Provider URL
    https://www.ransomware.live/
    Feed id
    privtools-ransomposts
    Provider record id
    derived-sha256:a6b5f9a9a2c46adf6d0353d5cc8cb57b69a3449aaed880a18c652563da2c77fd
    Observed
    Source-published
    Retrieved
    Format
    json-array
    Transport
    https-json
    Overlap class
    primary
    Independent corroboration
    yes
  3. Provider credit
    cybercrime.works
    Provider URL
    https://cybercrime.works/leaks/c52a399a-b5b9-489c-a71a-e4da4cc4abc2
    Feed id
    cybercrime-works
    Provider record id
    c52a399a-b5b9-489c-a71a-e4da4cc4abc2
    Observed
    Source-published
    Retrieved
    Format
    paginated-rest
    Transport
    https-rest
    Overlap class
    primary
    Independent corroboration
    yes
  4. Provider credit
    RansomLook
    Provider URL
    https://www.ransomlook.io/
    Feed id
    ransomlook
    Provider record id
    derived-sha256:0f7fe3f1e89bd4fb801807bf80489b47bd0edaa23907c3905b47ef0243c21664
    MISP event UUID
    3e75a962-fdea-5657-a3d4-1aef48ab252d
    Observed
    Source-published
    Retrieved
    Format
    json-array
    Transport
    https-rest
    Overlap class
    primary
    Independent corroboration
    yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

  1. Provider update: recorded ; associated provider observation .
  2. Initial tracker record: recorded ; associated provider observation .