OneSource Medical Group Listed by genesis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
OneSource Medical Group was listed by the genesis ransomware group on March 07, 2026, after internal files were exfiltrated. Individuals whose information may have been included should review any notices from the company and consider protective steps such as monitoring accounts and placing fraud alerts.
What happened
Public reporting indicates that OneSource Medical Group was listed by the genesis group. The listing references a ransomware attack in which internal files were allegedly exfiltrated. No further details on the timing of the intrusion, the method of initial access, or the scale of the operation have been made public.
Who is genesis?
Genesis is a ransomware group that has conducted operations involving encryption of victim systems and the removal of data prior to ransom demands. The group maintains a leak site where it lists organizations it claims to have targeted. In this case the group claims OneSource Medical Group as a victim through that listing; independent confirmation of the claim has not been reported.
About OneSource Medical Group
OneSource Medical Group supplies revenue cycle management and medical billing services to healthcare providers. Organizations in this sector routinely process claims, patient demographics, insurance details, and payment records on behalf of medical practices and facilities. A compromise at such a firm can therefore touch data belonging to multiple downstream healthcare entities and their patients.
The information in question
The only detail released so far is that internal files were allegedly exfiltrated during a ransomware attack. The exact categories of data contained in those files have not been disclosed.
- Organization listed by genesis ransomware group on March 07, 2026
- Internal files reported as exfiltrated
- Number of individuals affected remains unknown
The real-world impact
Where billing and revenue-cycle data are involved, exposed records can include identifiers that support identity theft or insurance fraud. Organizations may face regulatory scrutiny and operational disruption while restoring systems. Individuals whose information was processed by the firm have no confirmed public notice of the incident at this time.
Were you affected?
OneSource Medical Group has not issued a public statement confirming which individuals, if any, had data involved. People who have received services from providers that use OneSource for billing can take standard protective steps while awaiting further information.
Monitor financial accounts and explanation-of-benefits statements for unusual activity. Place a fraud alert or credit freeze with major bureaus if concerned about identity misuse. Review any communications received directly from OneSource or from the medical providers that engage its services. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
East Texas Family Medicine Listed by genesis Ransomware GroupMirage Endoscopy Center Listed by genesis Ransomware GroupFamily Medical Associates of Raleigh Listed by genesis Ransomware GroupThe American Board of Preventive Medicine Listed by genesis Ransomware GroupLatest breaches
Publicly posted by genesis — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.