Resource Corporation of America Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 4, 2026, the Medusa ransomware group listed Resource Corporation of America on its leak site and claimed to have exfiltrated internal files during a ransomware attack. The number of people affected has not been disclosed, and no further details on the scale or method of the incident have been made public. This listing occurs against a backdrop of sustained ransomware operations that continue to target organizations holding sensitive operational and financial records across multiple sectors.

What happened

Resource Corporation of America was listed by the Medusa group on the reported date. The group claims that internal files were exfiltrated in the course of a ransomware attack. No information has been released on the timing of the intrusion itself, the volume of data involved, or the specific techniques used. The number of individuals potentially affected remains unknown.

The group behind it: medusa

Medusa is a ransomware operation that maintains a public leak site and follows a double-extortion model, in which data is both encrypted and threatened with publication. The group has appeared in multiple public listings involving organizations in different industries. Its listing of Resource Corporation of America constitutes a claim by the group; independent confirmation of the underlying access or data removal has not been provided in available reporting.

Resource Corporation of America and its sector

Resource Corporation of America provides third-party eligibility and revenue-cycle services to hospitals, focusing on converting at-risk accounts into revenue under complex healthcare payment rules. The company states it has operated for more than thirty years, maintains a headquarters at 1120 Marina Bay Dr, Kemah, TX, and has processed more than two billion dollars in patient account charges. Organizations in this segment routinely handle detailed financial and eligibility records tied to hospital billing and Medicaid-related processes.

What was likely exposed

The only data category named in connection with the listing is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been disclosed. Healthcare revenue-cycle firms of this type commonly maintain records that include patient account details, eligibility documentation, and billing information, yet the exact scope and sensitivity of any material removed in this case remain unconfirmed.

Why it matters

Exposure of internal operational files from a revenue-cycle vendor can create downstream effects for the hospitals that rely on the firm, including potential complications in billing accuracy and eligibility verification. For individuals whose account information appears in such files, the primary concerns are financial fraud and misuse of personal identifiers already present in healthcare billing systems. The absence of confirmed data volumes leaves the full extent of these risks undetermined at present.

If your data was in this claimed breach

Individuals concerned about possible exposure should begin with basic account monitoring and credential hygiene. Public detail on the specific records involved is limited, so verification through official notifications from affected hospitals or the company itself remains the most direct route to confirmation.

• Review recent statements from hospitals or billing services you have used for any notices about the incident.
• Monitor financial accounts and insurance explanations of benefits for unexpected activity.
• Run a free exposure scan of your email address against known breach data sets to check for prior appearances of your information.
• Replace passwords on any patient-portal or billing accounts and enable multi-factor authentication where available.

AICompiled with AI assistance from public sources and published under our editorial standards.