Rocky Mountain Associated Physicians listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: January 30, 2026

The threat actor known as pear has listed Rocky Mountain Associated Physicians on its dedicated leak site. According to the announcement, the group claims to have successfully targeted the healthcare organization and obtained access to its internal systems and sensitive data.

Details of the alleged attack

The pear group made its announcement on January 30, 2026. In the post, the group claims that they achieved unauthorized access to the organization's systems on January 26, 2026. While the group has claimed responsibility for the incident, public information regarding the specific identity and technical capabilities of the pear group remains limited.

The group alleges that the breach resulted in the compromise of a dataset containing various types of sensitive information. This includes not only operational data but also highly sensitive patient-related documentation. The timing of the claim suggests the attackers had access to the network for several days prior to the public announcement on their leak site.

Compromised data types

According to the claims made by the threat actor, the stolen information is quite extensive and covers multiple facets of the organization's operations and patient care. The data allegedly includes the following:

• Patient information
• Patient records
• Physician notes
• Medical correspondence
• Operational data

The disclosure of such a wide range of information suggests that the attackers may have targeted various departments within the organization to maximize the impact of the breach.

About Rocky Mountain Associated Physicians

Rocky Mountain Associated Physicians is a healthcare organization based in Utah. The clinic specializes in bariatric surgery and provides various medical weight loss solutions to its patients.

Risk assessment and industry implications

The claims made by the pear group pose a significant risk to patient privacy and overall data security. Because the organization operates within the healthcare sector, the alleged exposure of these specific data types could fall under the purview of HIPAA regulations, which may lead to significant legal consequences for the entity involved.

The potential impact of this breach extends to several areas. For the patients, the exposure of medical records and physician notes increases the likelihood of them being targeted by identity theft or highly specific, targeted phishing attacks. For the organization, the disclosure of operational data could result in substantial business disruptions and long-term reputational damage.

In modern ransomware campaigns, threat actors frequently employ double extortion tactics. This involves not only encrypting an organization's data to disrupt operations but also stealing the data to use as leverage during ransom negotiations. The threat actor may threaten to leak the sensitive information on public forums if the ransom is not paid, thereby increasing the pressure on the victim.

To defend against such threats, organizations in the healthcare sector typically focus on several defensive strategies. These include implementing robust multi-factor authentication (MFA) across all remote access points, maintaining rigorous patch management schedules to close vulnerabilities, and ensuring that sensitive data is encrypted both at rest and in transit. Furthermore, continuous monitoring of network traffic and regular employee training on phishing awareness are essential components of a comprehensive cybersecurity posture designed to mitigate the risk of unauthorized access and data exfiltration.