Secure Health Listed by genesis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 31, 2026, the ransomware group genesis listed Secure Health on its data-leak site. The listing states that internal files were taken during a ransomware operation against the organization, which supplies administrative, care-management and wellness services to employers that maintain self-funded group health plans. No figure for the number of individuals affected has been released, and the company has not issued a public statement confirming or denying the claims.

Inside the incident

The only confirmed detail is the March 31 listing itself. The group asserts that files were removed from Secure Health systems, yet no volume, file categories or encryption status has been disclosed. Timing of the intrusion, the initial access method and whether any data was later published remain unknown. Public reporting has not identified a ransom demand or any payment.

Who is genesis?

Genesis is a ransomware operation that has appeared on leak sites since at least 2023. Like other groups in this category, it typically combines file encryption with the threat of publishing stolen data if a ransom is not paid. Its listings have included healthcare, manufacturing and government entities in prior incidents. The current claim against Secure Health follows the same pattern of posting a victim name and asserting data theft, without independent verification of the material’s contents.

Secure Health and its sector

Secure Health performs administrative and care-management functions for self-funded employer health plans. Organizations in this segment routinely process eligibility records, claims data, provider contracts and employee wellness information. Because these entities sit between employers, insurers and medical providers, they accumulate records that can contain both personal identifiers and clinical details. A successful intrusion therefore touches data that is both operationally sensitive and subject to regulatory protections.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data fields has been released. Entities of this type commonly hold enrollment forms, claims histories, member identifiers and limited clinical notes, yet the precise categories taken in this case are unconfirmed. Until Secure Health or an official investigation publishes a detailed notice, the exact scope of personal information cannot be stated as fact.

Why it matters

Even without a confirmed count of affected individuals, exposure of internal health-plan files can create downstream risks such as identity misuse or targeted fraud. Employers that contract with Secure Health may face compliance obligations under laws governing protected health information. For the organization itself, the incident adds operational costs for investigation, notification and potential remediation regardless of whether the files are later shown to contain personal data.

Were you affected?

Individuals who receive coverage through an employer plan administered by Secure Health should watch for official notices from their plan sponsor. Practical first steps include reviewing account statements for unusual activity, enabling multi-factor authentication on any linked portals, and requesting an explanation of benefits from the plan administrator. Readers can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.