Rocky Mountain Associated Physicians Listed by pear Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 26, 2026, the ransomware group pear listed Rocky Mountain Associated Physicians on its leak site. The listing states that internal files were exfiltrated during a ransomware attack against the Utah-based medical practice. No information has been released on the number of individuals affected or the precise volume of data involved. This incident occurs amid ongoing ransomware activity targeting healthcare organisations, where attackers frequently combine encryption with data theft to pressure victims.

What happened

The reported event centres on a ransomware attack that resulted in the exfiltration of internal files from Rocky Mountain Associated Physicians. The breach was publicly noted when the group pear added the organisation to its leak site on January 26, 2026. Details such as the date of the initial intrusion, the method of access, the duration of the operation, and any ransom demands remain undisclosed. The scale of the incident, including the number of records or individuals potentially impacted, has not been confirmed by the organisation or by investigators.

The group behind it: pear

Pear is a ransomware operation that maintains a leak site to publish data it claims to have obtained from victims. Such groups commonly employ double-extortion tactics, first encrypting systems and then threatening to release stolen files if payment is not made. Public records of pear’s activity show it has targeted organisations across multiple sectors, though specific claims made about any single victim require independent verification. In this case, the group’s listing of Rocky Mountain Associated Physicians constitutes an assertion by the actor rather than a confirmed account from the victim or law enforcement.

About Rocky Mountain Associated Physicians

Rocky Mountain Associated Physicians operates as a medical practice in Salt Lake City, Utah, specialising in bariatric surgery and medical weight-loss services. Organisations of this type maintain clinical records, scheduling systems, billing information, and internal administrative files as part of routine operations. A compromise at such a facility can affect both the continuity of patient care and the confidentiality of records held by the practice.

What data was at risk

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. The exact contents of those files have not been disclosed. Medical practices routinely handle patient identifiers, treatment histories, insurance details, and operational documents; however, whether any of these categories were among the exfiltrated material remains unconfirmed.

What's at stake

For individuals whose information may be contained in the files, potential consequences include unauthorised disclosure of personal health or financial details. For the organisation, the incident raises questions about operational disruption, regulatory obligations under healthcare privacy rules, and the costs associated with investigation and recovery. No public statements from Rocky Mountain Associated Physicians regarding remediation steps or notifications have been referenced in available reporting.

Were you affected?

Individuals who have received care from Rocky Mountain Associated Physicians can contact the practice directly for information on any notifications or protective measures being offered. A practical first step is to monitor statements from the organisation and to review personal accounts for unusual activity. Readers may also run a free exposure scan of their email address against known breach data sets to determine whether their information appears in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.