MC-Rx Listed by genesis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 31, 2026, the ransomware group genesis listed MC-Rx on its leak site and stated that internal files had been exfiltrated during a ransomware attack. The number of people affected is not known, and no further details about the timing, method, or volume of data have been released by the organization or confirmed through independent reporting. This incident occurs against a backdrop in which ransomware groups continue to target organizations that manage sensitive operational and personal information, often combining encryption with the threat of data publication.

Inside the incident

The only confirmed public information is the March 31, 2026 listing by genesis. The group asserts that files were removed from MC-Rx systems. No statement from MC-Rx has addressed the claim, and the scale of any encryption or the duration of any unauthorized access remains undisclosed.

Who is genesis?

Genesis operates as a ransomware group that employs a double-extortion model: it encrypts systems and then lists victims on a leak site when payment demands are not met. Public records show the group has claimed responsibility for intrusions across multiple industries in recent years, typically advertising stolen files to pressure targets.

About MC-Rx

MC-Rx, previously known as MC-21 and ProCare PBM, functions as a pharmacy benefit manager. Entities in this sector process prescription claims, maintain formularies, and handle data exchanges between pharmacies, insurers, and plan sponsors. A compromise at such an organization can affect downstream services even when the precise records involved are not yet specified.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or record categories has been published. Pharmacy benefit managers routinely process claims data, prescriber information, and eligibility records, but whether any of those categories appear in the exfiltrated material has not been confirmed.

Why it matters

Operational records held by benefit managers can reveal patterns of medication use and business relationships. When such material is removed, affected organizations face potential regulatory scrutiny and the need to review downstream data-sharing agreements, regardless of whether the files are later published.

If your data was in this claimed breach

Public information does not yet identify specific individuals. Those concerned can take the following steps:

• Review account statements from health plans and pharmacies for unexpected activity.
• Enable multi-factor authentication on any portals that store prescription or benefits information.
• Request an explanation of benefits from their plan administrator to verify recent claims.
• Run a free exposure scan of their email address against known breach repositories to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.