Rocky Mountain Associated Physicians, P.C. recently disclosed a data breach involving unauthorized access to its systems, potentially exposing sensitive personal, medical, and financial information. The incident, confirmed in February 2026, may impact patients whose data was stored in the organization’s databases.
Rocky Mountain Associated Physicians, P.C.’s Data Breach Investigation
Rocky Mountain Associated Physicians, P.C., a healthcare provider based in Salt Lake City, Utah, reported a significant cybersecurity incident involving unauthorized access to its systems. According to the notice, an advanced malicious cyber actor gained access to certain databases, including patient records and other sensitive data files, beginning no earlier than October 30, 2025.
The breach went undetected for several months until February 2, 2026, when the organization confirmed that patient information may have been compromised. This delay between intrusion and detection is particularly concerning, as it may have allowed the attacker extended access to sensitive data.
Upon discovery, Rocky Mountain immediately initiated a comprehensive response, including securing its systems, engaging a third-party forensic investigation firm, and notifying law enforcement authorities. The organization also reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Internet Crime Complaint Center (IC3).
The investigation determined that the attacker may have accessed a wide range of highly sensitive information stored within the organization’s systems. Healthcare providers are frequent targets of cyberattacks due to the value of protected health information (PHI), which can be used for identity theft, insurance fraud, and other malicious purposes.
While the total number of affected individuals has not been disclosed, the breadth of data involved suggests a potentially significant impact. In response, Rocky Mountain is implementing additional security safeguards and strengthening its cybersecurity posture to prevent future incidents.
To support affected individuals, the organization is offering 12 months of complimentary credit monitoring and identity restoration services through Experian IdentityWorks.
When Did This Breach Occur?
The Rocky Mountain Associated Physicians data breach began no earlier than October 30, 2025, when unauthorized access to its systems first occurred.
The breach was discovered and confirmed on February 2, 2026.
What Information Was Breached?
The potentially exposed information includes:
- Full names
- Dates of birth
- Social Security numbers
- Addresses and contact information
- Medical record numbers
- Diagnosis and treatment information
- Health insurance information
- Financial information (e.g., credit/debit card numbers and PINs)
Not all data elements were involved for every individual, but the combination of personal, medical, and financial data significantly increases the risk of identity theft and fraud.
What You Can Do
If you were affected by the Rocky Mountain Associated Physicians, P.C. data breach, consider taking the following steps:
- Enroll in credit monitoring: Take advantage of the free 12 months of Experian IdentityWorks services offered by the organization.
- Monitor your financial accounts: Review bank statements and credit card activity for unauthorized transactions.
- Check your credit reports: Obtain free credit reports from Equifax, Experian, and TransUnion to identify suspicious activity.
- Watch for medical identity theft: Be alert to unfamiliar medical bills or insurance claims.
- Place a fraud alert or credit freeze: These measures can help prevent unauthorized credit activity.
- Report suspicious activity: Contact your financial institution, healthcare provider, or law enforcement if you notice anything unusual.
Taking proactive steps can help reduce your risk and provide early detection of misuse.
File a Data Breach Lawsuit Against Rocky Mountain Associated Physicians, P.C.
If your personal, medical, or financial information was exposed in the Rocky Mountain Associated Physicians data breach, you may be eligible to pursue compensation through a class action lawsuit. Data breaches involving healthcare providers can have serious long-term consequences, including identity theft, financial loss, and privacy violations.
Filing a claim can help you recover damages for financial losses, time spent protecting your identity, and emotional distress. It also helps hold organizations accountable for failing to safeguard sensitive patient information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
