OneSource Medical Group Listed by Genesis Ransomware Group

On March 7, 2026, healthcare revenue cycle management and billing provider OneSource Medical Group appeared on the leak site of the Genesis ransomware group, with internal files reportedly exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates that Genesis posted a listing for OneSource Medical Group on its dark web leak portal. The entry states that attackers exfiltrated internal files after gaining access to the company’s systems. No precise count of affected individuals has been released, and the exact volume or sensitivity of the stolen data remains undisclosed in available reporting. OneSource provides revenue cycle management and billing services to healthcare organizations, meaning patient records, insurance details, billing information, and employee data were likely among the materials at risk.

The March 7, 2026 listing follows the group’s standard pattern of publishing samples or announcements after encryption and exfiltration. Ransomware.live tracked the post at the onion address referenced in the primary source.

Why This Matters for You and Your Family

When a medical billing company loses control of internal files, the information exposed often includes names, addresses, dates of birth, Social Security numbers, insurance policy numbers, and clinical billing codes tied to real medical procedures. This combination gives identity thieves everything needed to file fraudulent tax returns, open accounts in your name, or impersonate you with insurers.

Your family’s health and financial records are now potentially circulating among criminals. Children’s data is especially attractive because it can remain undetected for years. A single breach like this can trigger years of cleanup if the files reach data brokers or underground marketplaces.

The Doxxing and Identity-Chain Implications

Stolen medical billing files rarely stay isolated. Attackers routinely cross-reference exposed emails, phone numbers, and addresses with credential leaks from other services. This creates an identity chain that links your work email to personal accounts, gaming usernames, and family member profiles. Once the chain is mapped, targeted doxxing, SIM-swapping, and account takeovers become straightforward.

Credential leaks like this one cascade into gaming account compromises. Children’s Roblox, Fortnite, or Steam accounts frequently reuse passwords or recovery emails that appear in healthcare data sets, turning a medical breach into a direct route to family photos, chat logs, and location data.

Genesis Ransomware Group Track Record

Public reporting attributes the Genesis ransomware group with emerging in late 2023 as both a ransomware operator and initial access broker. The group has listed hundreds of victims, including mid-sized healthcare providers, manufacturers, and professional services firms. Its typical playbook involves phishing or exploitation of remote desktop services for initial access, followed by data exfiltration and deployment of ransomware. Genesis then demands payment for decryption and to prevent file publication, frequently leaking samples on its dedicated site when victims do not pay.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can break the chain before criminals exploit it.
• Rotate any password you used at OneSource Medical Group or its client portals anywhere else it appears, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and recovery emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing accounts and monitoring statements.

The incident underscores that healthcare billing data is now a routine target, and waiting for notification letters leaves your family exposed. Start your DoxxScan trial today for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that links handles to real identities, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. OneSource Medical Group is simply the latest name on a growing list; proactive steps now can limit the damage from the next breach that has not yet been announced.