[PEAR] – Ransomware Victim: Navigator Business Solutions

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the PEAR Onion Dark Web Tor Blog page.

Ransomware group:
PEAR
Victim name:
NAVIGATOR BUSINESS SOLUTIONS

AI Generated Summary of the Ransomware Leak Page

Navigator Business Solutions, a US-based technology firm focused on ERP software, appears as a ransomware victim in a leak post dated 2025-10-02. The post is attributed to the PEAR group and framed under the header Pure Extraction And Ransom, signaling a data-exfiltration and ransom operation. The leak page asserts that roughly 9.9 terabytes of data belonging to NBS clients—including files and SQL databases—were accessed, underscoring the scale of impact on client data. The page lists a company site defanged as nbs-us[.]com and mentions revenue of about $17.2 million, placing Navigator Business Solutions within the ERP software sector in the United States. An email address appears in the excerpt but has been redacted for privacy, and a claim URL is indicated as present (defanged). The content supports a double-extortion narrative, though no ransom amount is disclosed in the visible text.

No images or screenshots are shown on the leak page (0 images) and there are no publicly downloadable files indicated (downloads_present is false). The metadata identifies Navigator Business Solutions as an ERP software provider in the United States, with data exfiltration claimed from NBS clients amounting to 9.9 TB. The post date is 2025-10-02; no separate compromise date is provided, so this date is treated as the post date. The excerpt does not disclose any ransom figure. A defanged claim URL and a defanged site reference are included, while other company names mentioned in the body text have been ignored for this CTI report. The victim name is preserved for documentation purposes.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features