The $1,000 reward offered by the U. for recovery of the data was pivotal, Winder said, and one person will likely get the reward.

Media announcements of the reward and street work by detectives got the attention of those believed responsible for the theft, he said, and "got their jaws a waggin'," which led to the recovery. The case was broken, he said, "with enough pressure and an incentive."

Investigators believe that one individual broke into the car and the others participated post-crime. They may face different charges. Hartman was not believed to be the person who actually burglarized the car, said Capt. Teri Sommers of the Kearns/Magna Precinct, which recovered the tapes.

Monday night, sheriff's dispatchers received a call that broke the case. Sommers was alerted, and within a couple of hours detectives from her precinct met with an unnamed individual on a roadside or parking lot near 300 West and 1100 South in Salt Lake City, where the tapes were handed over.

"Based on the fact that they were returned in the original box in the original condition, there's no indication the information on the tapes has been accessed or misused," said David Entwistle, CEO of University of Utah Hospitals and Clinics. "The tapes are now in the hands of the FBI for forensic analysis."

There's no indication the suspects were shopping for someone who could tap into the information, described as having "some level of encryption," Winder said. And they have found no evidence that the suspects had the technology to get at the data themselves.

"A key point of the investigation is to get these guys to tell us straight up" what they did with the tapes while they had them for three weeks, he said.

Winder praised the U. for its efforts to see that patient interests were protected. Entwistle said they notified the patients by mail of the theft and offered the nearly million people whose records contained Social Security numbers free credit monitoring for a year, an offer that stands. He said that many of the records contain Social Security numbers because that's the identifier used by Medicare and Medicaid. It's also required of anyone seeking financial assistance. But it's otherwise just one form of identification the U. accepts from patients.

Winder said criticism the U. received for the reward's size was unwarranted. His office recommended that amount. To overvalue the data, he added, would be to make it "a Willie Wonka gold bar."

Winder said that besides those whose data potentially made them vulnerable to identity theft, there were three other serious victims to the crime: the U., Perpetual Storage and the courier, who "made a mistake and was victimized as well. On a personal level, he probably suffered more than anyone else."