HealthConsent
Active breach tracker Salt Lake City, UT Disclosed April 21, 2026

Rocky Mountain Associated Physicians Data Breach 2026 (Utah Bariatrics, PEAR Ransomware): 50,640 Bariatric Patients Exposed. Data Leaked. What To Do

Rocky Mountain Associated Physicians, P.C., operating as Utah Bariatrics, a Salt Lake City bariatric surgery and medical weight-loss practice, disclosed in April 2026 a 2025 PEAR ransomware attack exposing names, Social Security numbers, dates of birth, medical records, diagnoses, treatment information, and (for some patients) payment card data and PINs for 50,640 affected individuals. Data was not paid for and was leaked. 12 months Experian IdentityWorks offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Oct 30, 2025

Unauthorized access window begins (approximate)

Jan 30, 2026

PEAR posts RMAP to dark-web leak site

Feb 2, 2026

Forensic investigation confirms patient database access

Apr 13, 2026

Individual notification letters mailed

Apr 21, 2026

Filed with HHS OCR

Data exposed

01

High-risk identity

Enables financial + identity theft

Date of birth Social Security number

02

Health records

Don't expire and can't be reissued

Medical record number Diagnosis and treatment information

03

Contact & insurance

Phishing + targeted scams

Full name Home address Contact information Health insurance information Debit / credit card numbers and PINs (for some individuals)

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Edelson Lechtzin (publicly investigating) Barnow & Associates (publicly investigating) Migliaccio & Rathod (publicly investigating) Bryson Harris Suciu & DeMay (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Rocky Mountain Associated Physicians, P.C. (RMAP) is a Salt Lake City practice operating under the trade name Utah Bariatrics. For 40+ years RMAP has been one of the Mountain West’s most established bariatric surgery and medical weight-loss providers, performing gastric bypass, sleeve gastrectomy, duodenal switch, SADI-S, revision surgery, and GLP-1 medical weight-loss programs. The patient population is by definition individuals with obesity and metabolic disease — a stigma-sensitive demographic with specific exposure risks (employment background checks, insurance underwriting, targeted counterfeit-GLP-1 outreach).

On approximately October 30, 2025, an unauthorized actor began accessing RMAP’s network. The PEAR (“Pure Extortion and Ransom”) group later claimed responsibility, posting RMAP on its dark-web leak site on January 30, 2026 and claiming approximately 1.7 TB of exfiltrated data. RMAP did not pay the ransom; PEAR subsequently leaked the stolen data.

On February 2, 2026, RMAP’s forensic investigation confirmed access to its patient database. RMAP mailed individual notification letters and issued a press release on April 13-14, 2026, and the HHS Office for Civil Rights portal posting was updated on April 21, 2026 — confirming 50,640 affected current and former patients.

What was stolen

Per RMAP’s notice, exposed data includes:

  • Full name
  • Date of birth
  • Social Security number
  • Home address
  • Contact information
  • Medical record number
  • Diagnosis and treatment information (bariatric / weight-loss procedure history)
  • Health insurance information
  • For some individuals: debit and credit card numbers, including PINs

The bariatric-specific treatment context plus full SSN plus card-with-PIN exposure for some patients makes this one of the more clinically and financially severe small-clinic breaches of 2026.

What RMAP is offering

  • 12 months of complimentary credit monitoring and identity restoration via Experian IdentityWorks
  • Toll-free response line: 800-999-9970
  • Email: [email protected]

What to do

  1. Enroll in Experian IdentityWorks through the code in your letter.
  2. Cancel and reissue any debit or credit cards used at RMAP / Utah Bariatrics. PIN exposure means stop using the existing card immediately.
  3. Place free credit freezes at Equifax, Experian, and TransUnion.
  4. File IRS Form 14039.
  5. Be alert to counterfeit-GLP-1 and weight-loss-medication scam outreach. With your specific bariatric-treatment context known to scammers, “your follow-up GLP-1 prescription is delayed, click here” phishing is realistic.
  6. Stop the ongoing flow of your bariatric treatment data. HealthConsent files HIPAA restriction requests so the bariatric-specific treatment data exposed in this breach is not continuously re-shared by downstream entities. Because PEAR published the data, your record is in the wild.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.