Mogren, Glessner & Ahrens, P.S. Ransomware: Pear Group Claims Disruption (August 2026)

Mogren, Glessner & Ahrens, P.S.: What Happened

Mogren, Glessner & Ahrens, P.S., a professional services firm specializing in family law and based in the United States, has been named by the Pear ransomware group as a recent victim. The group publicly claimed responsibility for an attack that allegedly targeted the firm's internal systems. While the firm has not issued a public confirmation, the attack is believed to have resulted in potential data encryption and operational disruption. The incident is notable for its targeting of a legal services provider, a sector increasingly affected by ransomware activity in North America.

Attack Vector & Technical Detail

The Pear ransomware group has not disclosed the specific attack vector used in this incident, and no CVEs or IOCs have been publicly attributed at this stage. However, analysis of the group’s typical modus operandi and the MITRE ATT&CK tactics referenced (TA0006: Credential Access and TA0040: Impact) suggest that initial access may have been achieved through compromised credentials, possibly via phishing or brute-force attacks. Following access, Pear likely deployed ransomware to encrypt critical data and disrupt business operations. The absence of confirmed IOCs or technical indicators limits the ability to attribute specific tools or malware variants, but the group’s history and public claims indicate a focus on operational disruption and extortion.

Confirmed Impact

The full impact on Mogren, Glessner & Ahrens, P.S. remains unconfirmed, as the organization has not publicly acknowledged the breach. Based on the Pear group’s claims, the attack may have resulted in the encryption of sensitive legal documents and disruption of ongoing legal services. As a professional services firm operating in North America, the potential exposure of confidential client information could have regulatory and reputational consequences, particularly under US data protection laws. The incident underscores the vulnerability of legal sector organizations to ransomware threats and the operational risks posed by such attacks.

What This Means for Your Organization

This incident highlights the persistent threat posed by ransomware groups like Pear, especially to organizations handling sensitive client data. The use of credential access and impact tactics (MITRE TA0006, TA0040) demonstrates the importance of robust access controls and rapid detection of anomalous activity. Legal and professional services firms should prioritize multi-factor authentication, regular credential audits, and comprehensive incident response planning. Proactive monitoring for unauthorized access attempts and timely backup of critical data are essential to mitigate the risk of operational disruption and data loss.

Detection & Response

• Immediate: Review and secure all privileged accounts; enforce multi-factor authentication across the organization.
• Hunt: Monitor for unusual authentication attempts and lateral movement consistent with MITRE TA0006 (Credential Access) and TA0040 (Impact) tactics.
• Patch: N/A (no CVEs disclosed in this incident).

Source: https://www.hendryadrian.com/ransom-mogren-glessner-ahrens-p-s-aug-2026/