Pear, a data-extortion group that brands itself “Pure Extraction And Ransom,” has named Bridgestone HosePower, LLC on its dark web leak site. HosePower is a U.S. distributor of Flextral hydraulic and industrial hose that also runs mobile hose-repair trucks and OEM hose centers across roughly 47 U.S. branches. The leak-site entry is dated November 3, 2026, and leak trackers picked it up on November 5. As of November 6, there is no statement from the company, no sample data, no published ransom demand, and no independent forensic finding. This is an unverified claim, not a confirmed breach. 

It still deserves attention from industrial operators, for a reason that has little to do with Pear’s credibility. Suppliers sit inside their customers’ maintenance routines, inventory systems and inboxes. When one is named by an extortion group, every customer has to answer the same question: what do we trust this company with, and what would it mean if that trust were abused? 

Quick answer. Did Pear ransomware breach Bridgestone HosePower? Pear says so. Nobody has verified it. Pear is documented as stealing data without encrypting systems, so any impact on hose supply would more likely come from the company’s response than from locked servers. 

What happened? Understanding the Bridgestone HosePower ransomware claim 

Ransomware.live lists the victim as Bridgestone HosePower, LLC (hosepower.com), discovered November 5, 2026 at 11:15 UTC, with an estimated attack date of November 3 and the description “A distributor for Flextral Hydraulic Hose and Industrial Hose Products.” The estimated attack date should be read as the tracker’s best guess. RedPacket Security states plainly that November 3 is the post date, not a compromise date, and that the post does not say whether data was stolen or systems were encrypted. It also reports no ransom figure, no data volume and no downloadable files. Ransomware.live holds a screenshot of the listing, which we could not examine. 

RedPacket attaches a standing caution to its Pear pages: listings attributed to the group have been reported to include unverified or fabricated victim claims. That caution has support elsewhere. When Comparitech reviewed Pear in October 2025, four of its claims were confirmed and 31 were not acknowledged by the named organizations. Halcyon, on the other hand, reports that a large share of claims have led to confirmed leaks, though it also says whether leak-site removal correlates with payment is unverified. The honest summary is that Pear’s claims are sometimes real and sometimes not, and a listing alone cannot tell you which. 

We found no statement from Bridgestone HosePower or Bridgestone Corporation. The absence of a statement is not confirmation or denial; companies often stay quiet while counsel and forensic firms work. 

What is and is not established 

Timeline (dated sources only) 

If you landed here after searching “Bridgestone cyberattack,” note that Bridgestone Americas confirmed a separate “limited cyber incident” at North American plants in September 2025, as BleepingComputer reported. Nothing we reviewed connects that event to Pear or to HosePower. 

Who is Pear ransomware? 

Definition. Pear (Pure Extraction And Ransom, also written PEAR) is a financially motivated extortion group, active since mid-2025, that steals data and demands payment to delete it and de-list the victim, without deploying ransomware encryption. 

The group surfaced with a coordinated launch: 18 victims on one day in August 2025, according to Cyber Daily, and a FAQ page ready at launch. Tracker totals now run from about 120 to 140 victims depending on the source and cut-off date; Breachsense counts 130 with the latest posted November 3. Ransomware.live shows Pear posting several victims in the days around the HosePower listing, including software and healthcare organizations. 

On method, Halcyon’s profile is the most detailed public account. It describes a closed team with no affiliate program, no custom malware and no persistent implants, reliant on stolen credentials and built-in or legitimate administrative tools. At-Bay independently describes the same model, noting direct text and WhatsApp messages to employees and file-transfer tools such as WinSCP and Rclone, often renamed to avoid detection. Bitdefender compares Pear with Coinbase Cartel as data-theft-first groups that avoid encryptors. 

Verified characteristics of Pear 

Two points matter for this case. First, Halcyon says Pear predominantly targets organizations under $5 million in revenue. A multi-state distributor with dozens of branches would be an outlier, which is one reason to hold the claim loosely. Second, the nearest Pear precedent for a supplier is Motility Software Solutions, a Reynolds & Reynolds unit whose breach Pear claimed and which later notified about 766,670 people. That shows Pear data theft can hit a supplier’s customers’ data, not that HosePower was similarly affected. 

For related threat research, see Shieldworkz industrial threat intelligence offering. 

Who is Bridgestone HosePower, and why does it matter? 

Bridgestone HosePower sells and services hydraulic and industrial hose. A trade profile traces it to a 1983 firm called Hydraulic Engineering, later renamed Masthead Industries, and says Bridgestone Corporation bought it in 2014. It has since grown through acquisitions including Industrial Rubber Co. in New Jersey, Fittings Inc. in Seattle and, in December 2023, Cline Hose & Hydraulics. The 2023 release put it at 47 U.S. branches plus one in Mexico and called it a wholly owned indirect subsidiary of Bridgestone Corporation; we could not confirm that structure is unchanged in 2026. 

Its own site describes the largest mobile hose-repair fleet in America, on-site repair for hydraulic hose up to 6,000 psi, and its status as master distributor of the full Flextral line. Its OEM hose centers offer proof testing, custom kitting, labeling, vendor-managed inventory and just-in-time delivery. Product lines span hydraulic, air, water, petroleum, chemical, oil and gas, marine, food and beverage, and steam hose. Older trade coverage lists mining, timber, automotive manufacturing, road construction and oil service among its customers. 

Why does a hose distributor matter to industrial security? Because hydraulic hose is a consumable that fails without warning, and when it does, a machine stops. Mining haul trucks, excavators, press lines and drilling equipment all depend on someone being able to cut and crimp a replacement quickly. A distributor with mobile service and vendor-managed inventory is woven into the maintenance routine of its customers, and that is where a supplier incident can bite, even if no production network is touched. 

Three cautions keep this honest. We have no evidence that any HosePower customer or facility is affected. We have no public information about HosePower’s IT architecture or whether it operates OT, and we do not assume it does. And an incident at HosePower would not by itself mean Bridgestone Corporation or any other Bridgestone unit was affected. Exposure scenarios later in this article are hypotheses for planning, not findings. 

How could an attack like this happen? 

The intrusion method in this case is unknown. What follows separates what is documented about Pear from plausible pathways any ransomware or extortion group could take. 

What is Pear-specific. Halcyon reports credential reuse and credentials from third-party breach data as the main foothold, phishing as a supplement, and exposed RDP or VPN without MFA as a third route. Intrusions have included legitimate remote-monitoring tools, with EDR and audit logging disabled before exfiltration, domain-level privilege escalation, new or modified accounts for fallback access, data moved with WinSCP and Rclone over days to weeks, and backups deleted and logs cleared at the end. No exploited CVE has been attributed. Halcyon’s mappings include T1078 (Valid Accounts), T1566 (Phishing), T1562 (Impair Defenses), T1567 (Exfiltration Over Web Service), T1490 (Inhibit System Recovery) and T1070 (Indicator Removal). T1486 (Data Encrypted for Impact) does not appear, which is consistent with the no-encryption model. 

What is generic. Everything in the table below beyond those items is plausible tradecraft, not a reconstruction of this incident. The ATT&CK IDs marked with an asterisk are our own mappings, not vendor-sourced. 

Two observations about this particular victim, offered as context rather than cause. Ransomware.live’s DNS snapshot shows the domain uses Microsoft 365 mail and a DMARC record at p=none, which means spoofed mail from the domain is monitored but not blocked; that policy may have changed since the snapshot. The same page carries an OSINT exposure report listing 179 exposed passwords for the domain, with no indication of when or how they leaked. Neither fact shows how, or whether, anyone got in. Both are the kind of signal a credential-first group would find useful. Separately, if Pear’s reported four-week average dwell time held here, any compromise would predate the listing by weeks, which argues for log reviews that reach back at least 60 to 90 days. 

Potential impact on industrial supply chains 

This is where the claim matters most, and where precision matters most. A supplier incident can hurt customers in two different ways, and they need different responses. 

• Direct technical compromise: the attacker uses the supplier as a path into the customer’s systems, through shared credentials, remote access, integrations or trusted email. 

• Business dependency disruption: the customer’s systems are untouched, but something it relies on from the supplier slows or stops. 

The second is far more common and needs no attacker in the customer’s network at all. Real incidents show the range. None of them is evidence about HosePower. 

Walking through the twelve consequences industrial buyers should consider, with the caveat that each is a possibility to plan for, not something reported here: 

1. Supplier service disruption. Branch ordering, dispatch or invoicing slows while the supplier investigates. With a no-encryption group, this would stem from containment, not locked systems. 

2. Delayed maintenance. A mobile hose-repair team that cannot access work orders is a delayed repair for a mine, a quarry or a plant floor. 

3. Delayed component delivery. Standard hose is easy to substitute. Specified assemblies, certified fittings and custom kits are not. 

4. Procurement and inventory disruption. Vendor-managed inventory and auto-replenishment depend on data feeds and portals. If a supplier pauses them, the customer’s stock position becomes uncertain. 

5. Customer data exposure. Pear’s model is data theft. Order histories, contact lists, pricing, contract terms and site addresses are the kind of data a distributor holds. Whether HosePower’s were taken is unknown. 

6. Business email compromise. Stolen correspondence is raw material for invoice fraud: a convincing email from a known account manager with new bank details. Customers should expect lures that reference real orders. 

7. Loss of trust. Procurement teams may pause onboarding or review the relationship, with cost on both sides. 

8. Third-party connectivity. Punch-out catalogs, EDI links, VPNs and portal logins between supplier and customer are the points where trust is technical. 

9. Exposure of customer environments. Only if such connections exist and are poorly scoped could a supplier incident reach customer systems. Nothing indicates that here. 

10. Business continuity. Few buyers have tested what happens if a critical consumable supplier is unavailable for two weeks. 

11. Regulatory and contractual issues. Notification clauses, data-protection duties and flow-down terms decide who has to tell whom, and how fast. 

12. Operational resilience. The measure is whether maintenance continues when a named supplier cannot respond. 

Hypothetical scenario A (planning only). A customer’s plant uses a hose distributor’s portal to reorder fittings, with a shared account used by three maintenance planners. If the distributor were compromised and the portal credentials reused elsewhere, an attacker could try them on the customer’s email or VPN. The defense is unique credentials per user and MFA on any supplier-facing login. 

Hypothetical scenario B. A mining operator depends on a distributor’s mobile service trucks. If the distributor paused dispatch during an investigation, the operator’s equipment downtime would rise even though no mine system was touched. The defense is a second qualified source and a pre-positioned stock of critical assemblies. 

IT/OT cybersecurity implications 

For OT security leaders the question is narrower: could trouble at a supplier’s IT environment reach a plant’s control systems? Usually not directly. When it can, the path runs through trust relationships the plant created. 

An illustrative chain, which is a risk pattern and not a description of this incident: a supplier’s staff account is compromised; the account holds access to a customer-facing portal or support channel; the customer’s staff trust messages from it; one of those staff has remote access to an engineering workstation; the workstation has a route into a control network. Each link is a design choice. In ATT&CK for ICS terms the pivot would use techniques such as External Remote Services (T0822), Valid Accounts (T0859) and Remote Services (T0886). 

The January 2026 Secure Connectivity Principles for Operational Technology, led by NCSC-UK with CISA, the FBI and other agencies, give an eight-principle framework for designing and reviewing exactly these connections. For monitoring depth, Shieldworkz’s guide to network detection and response explains how OT-aware monitoring fits alongside a managed SOC. To repeat the caveat: nothing reported suggests that supplier-to-customer propagation is a feature of this incident. 

What are the potential damages? 

No reliable damage figures exist for Bridgestone HosePower, and we do not estimate any. The categories below are what an organization in this position typically weighs. 

For scale, the CDK figure above is an ecosystem estimate for a platform used by about 15,000 businesses, not a benchmark for a hose distributor. Pear’s own history shows another path: data-theft cases can still produce notification obligations measured in hundreds of thousands of people, as in the Motility case. 

Who could be behind the attack? 

The only defensible answer is: a group using the Pear brand has claimed it, and nothing beyond that is established. 

What is known: Pear’s leak site says the group is a private team with nothing in common with other threat actors. Halcyon found no technical or infrastructure overlap with known groups and no affiliate program. What is not known: who the operators are, where they live, whether they are a rebrand of an older crew, and whether any affiliates or access brokers feed them. SOCRadar’s group profile lists Russia as a source country and notes operators posing as penetration testers during negotiations; we found no supporting evidence for the country label in the material we reviewed, so we treat it as unverified. 

Attribution in this field is hard for structural reasons. A ransomware or extortion brand is a name on a leak site, not an organization chart. Operators can be a small core team, access can be bought from brokers, and affiliates can work under several brands. Infrastructure is Tor-hosted and disposable. And a group’s statements about itself, including its claim to independence, are marketing as much as fact. We make no claim about nationality, state sponsorship or individual identity. 

Recommended cybersecurity measures and remediation 

These steps apply to any industrial organization that buys from, or connects to, a supplier named on a leak site, and to suppliers themselves. They are organized by time horizon. 

Immediate actions (this week) 

1. Check what the supplier can reach. List every account, portal, VPN, EDI link and remote-support tool the supplier uses against your environment. Disable what is unused. 

2. Reset and re-scope shared supplier credentials. Force password resets on supplier-facing accounts and require MFA. 

3. Look for the known Pear footprint. Hunt for unapproved AteraAgent or Splashtop installs, WinSCP or Rclone binaries (often renamed), connections to file-sharing sites used for samples, and mail from the onionmail address Halcyon lists. Indicators are thin because Pear uses no custom malware. 

4. Review authentication logs. Look at the last 60 to 90 days for impossible travel, new MFA enrollments, new mailbox forwarding rules and logins from unfamiliar infrastructure. 

5. Review privileged accounts. Find new or recently modified admin accounts and any changes to password-reset paths. 

6. Verify backups. Confirm at least one copy is offline or immutable, and that restore has been tested. Pear reportedly deletes backups. 

7. Validate external exposure. Scan for exposed RDP, VPN portals and remote-management consoles. 

8. Tell staff and finance. Warn teams that lures referencing real supplier orders are likely, and require call-back verification for any change to payment details. 

9. Confirm EDR health. Check that agents are running, tamper protection is on and logs reach a system the endpoint cannot alter. 

If you need outside help on short notice, an OT incident response retainer is the usual arrangement. 

Short-term measures (30 to 90 days) 

• Roll out phishing-resistant MFA on email, VPN, remote access and supplier portals. 

• Enforce least privilege and separate admin identities. 

• Patch internet-facing systems, starting with actively exploited flaws. 

• Strengthen email security and move DMARC to enforcement. 

• Review VPN and remote access configurations; retire RDP exposure. 

• Add egress filtering and alerts on unusual outbound transfers. 

• Write and rehearse an incident response plan that includes a supplier-incident branch. 

• Add cyber requirements to supplier contracts: breach notice windows, MFA, logging, subcontractor flow-down. 

Long-term strategic measures 

• Implement IT/OT segmentation and an industrial DMZ. 

• Deploy continuous OT network monitoring. 

• Introduce privileged access management for OT and vendor sessions. 

• Establish vendor access governance with named owners and quarterly access reviews. 

• Run OT risk assessments that include third-party connections. 

• Build a tiered third-party risk program, with the closest scrutiny for suppliers that hold data on you, reach into your systems, or are hard to replace. 

• Run ransomware and data-extortion exercises, including a supplier-down tabletop. 

• Maintain business continuity plans with qualified alternate sources for critical consumables. 

Framework mapping 

Not every framework applies to every organization. NERC CIP, for example, binds registered entities in the bulk electric system, not a hose distributor or most manufacturers. Use the mapping as a menu. 

CISA’s CPG 2.0, released in December 2025, adds goals on third-party risk and zero trust. NIST CSF 2.0 added a Govern function and expanded supply chain risk management. For standards depth, see Shieldworkz IEC 62443 practical guide. The control IDs in the table come from standards documents we did not re-open for this article; confirm them against current editions before publishing. 

What should industrial organizations learn from this incident? 

The incident is unproven, and the lessons hold either way. 

• CISOs: supplier exposure is an inventory problem first. If you cannot list who can reach what, you cannot assess a leak-site listing. 

• CIOs: supplier connections should be built like internet-facing services: documented, scoped, logged and reviewable. 

• Chief Risk Officers: rank suppliers by dependency, not spend. A low-cost consumable supplier can be the one that stops a line. 

• OT Security Directors: treat every vendor path to the plant as a privileged path and keep it out of the corporate trust zone. 

• Plant managers: know which parts and services have a single source, and keep critical spares on site. 

• Manufacturing IT teams: watch for shared accounts and always-on connections inherited from older projects. 

• Supply-chain security leaders: build a standing playbook for “supplier named by an extortion group,” including who verifies, who communicates and what gets paused. 

• Third-party risk teams: questionnaires are a snapshot. Pair them with continuous signals such as leaked credentials, exposed services and email-authentication posture. 

Questions for the leadership team 

1. Do we know which suppliers have access to our systems? 

2. Are third-party connections monitored continuously? 

3. Can a compromised supplier account reach OT networks? 

4. Are IT and OT segmented, and has anyone tested it? 

5. Can we keep operating if a critical supplier becomes unavailable? 

6. Do we have tested alternative sourcing arrangements? 

7. Do we assess supplier cybersecurity maturity on a regular schedule? 

8. Do supplier contracts define incident notification duties and timelines? 

Shieldworkz expert perspective 

Industrial cybersecurity cannot stop at the boundary of one organization. Supplier relationships, trusted connections, remote access pathways and interconnected business processes are part of the attack surface, whether or not anyone drew them on the network diagram. 

One way to make that practical is to look at each critical supplier through three rings. 

• The data ring: what does the supplier hold about us? Order histories, site addresses, contacts, specifications, pricing. 

• The access ring: what can the supplier, or an attacker holding the supplier’s credentials, touch? Portals, VPNs, support tools, shared mailboxes, file transfers. 

• The dependency ring: what stops, and how fast, if the supplier cannot respond for days or weeks? 

Most third-party programs measure the data ring with a questionnaire. Fewer map the access ring technically, and fewer still test the dependency ring. The Pear listing is a useful prompt because a no-encryption group stresses the first ring, and the second if credentials were involved, while the third depends on how the supplier chooses to respond. 

The work that follows is practical and not specific to any one vendor. OT security assessments, based on IEC 62443, locate where supplier access meets control systems. Passive network visibility shows which external connections actually exist. OT penetration testing tests whether a supplier-originated foothold can move. Threat intelligence helps decide which supplier events deserve action. Segmentation, continuous monitoring, incident-response readiness and governance then make those findings durable. Shieldworkz lists each of these among its services; we make no claims here about any customer or about involvement in this incident. 

Conclusion 

Pear’s listing of Bridgestone HosePower is an allegation from a group whose claims are sometimes borne out and sometimes not. Nobody has confirmed an intrusion, theft of data, encryption or an outage, and the company has not spoken. That should shape how the story is told and how defenders respond. 

It should not shape whether they respond. Industrial suppliers are consequential targets because they sit inside maintenance, procurement and email workflows, often with trusted connections and long-lived accounts. Pear’s credential-first, no-encryption approach is a reminder that supplier incidents do not need malware that halts a plant to cause damage: stolen data, impersonation and cautious containment can do it. Where IT and OT are properly segmented and vendor access is controlled, a supplier-side event stays a business problem. Where they are not, it can become something larger. 

Business continuity must therefore reach beyond a company’s own perimeter. The takeaway for industrial security leaders: map each critical supplier by what it knows, what it can reach and what you cannot run without, and fix the weakest ring before a leak site makes the question urgent.

Additional resources     

Comprehensive Guide to Network Detection and Response NDR in 2026 here
OT Security Risk Exposure Calculator Workbook here
A downloadable report on the Stryker cyber incident here     
Remediation Guides here   
OT Security Best Practices and Risk Assessment Guidance here  
IEC 62443-based OT/ICS risk assessment checklist for the food and beverage manufacturing sector here