Rocky Mountain Associated Physicians Reports Massive Data Breach Affecting 50,640 Individuals Rocky Mountain Associated Physicians, P.C., a Salt Lake City-based medical group, disclosed a significant data breach impacting 50,640 individuals across the U.S. The incident was reported to the U.S. Department of Health and Human Services (HHS) on April 3, 2026, with a public notice posted on the company’s website. The breach was first exposed on January 30, 2026, when the cybercriminal group PEAR claimed on the dark web to have stolen 1.7 terabytes of data from the organization. The compromised information reportedly included: - Business operations and HR records - OneDrive files and email correspondence - Provider and vendor data - Patients’ personally identifiable information (PII) and protected health information (PHI) - Payment details, including credit/debit card numbers and PINs Regulatory filings confirmed that exposed data included names, dates of birth, Social Security numbers, addresses, medical records, diagnosis/treatment details, insurance information, and financial data. In response, Rocky Mountain Associated Physicians began notifying affected individuals and is offering 12 months of complimentary credit monitoring and identity restoration services through Experian IdentityWorks. The organization has provided a dedicated notice page for updates and can be reached at 801-268-3800 during business hours (Monday–Friday, 9 a.m.–5 p.m.).

Rocky Mountain Care Hit by Qilin Ransomware Attack, Exposing Sensitive Data Rocky Mountain Care, a Utah-based healthcare provider offering hospice, home care, skilled nursing, and rehabilitation services, suffered a cybersecurity breach between January 30 and February 2, 2026. The ransomware group Qilin claimed responsibility, alleging unauthorized access to the organization’s network and threatening to publish stolen data on the dark web. The breach was publicly disclosed on February 23, 2026, via the Tor network. Rocky Mountain Care, which operates multiple facilities across Utah and employs over 1,000 staff, confirmed the incident but has not yet determined the full scope of exposed data. While the company is investigating whether Protected Health Information (PHI) was compromised, affected individuals have not yet been notified. The firm stated it will directly contact impacted parties once its review is complete. Legal firm Shamis & Gentile P.A. is investigating potential compensation claims for those affected, citing possible exposure of personally identifiable information (PII). The incident underscores ongoing risks to healthcare organizations from ransomware attacks targeting sensitive data.