Resource Corporation of America Listed by medusa Ransomware Group

On January 4, 2026, Resource Corporation of America appeared on the Medusa ransomware group’s leak site with internal files the attackers claim to have exfiltrated during a ransomware incident. The company, based in Kemah, Texas, helps hospitals convert at-risk patient accounts into revenue through third-party eligibility services. While the exact number of individuals whose data may have been exposed remains unknown, anyone whose medical billing, insurance, or eligibility records passed through the firm in the past 30 years could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that Medusa posted proof of compromise on its dark-web leak portal, listing Resource Corporation of America as victim number 20058b47f2b4df7a0402f1fc268880b9. The exposed material consists of internal files exfiltrated before encryption. No confirmed count of stolen records has been published, and the company has not yet issued a public statement detailing the breach scope or timeline. Available reporting describes the headquarters at 1120 Marina Bay Dr, Kemah, TX, and notes the firm’s long-standing role processing more than two billion dollars in patient account charges for hospitals nationwide.

Why This Matters for You and Your Family

When a healthcare revenue-cycle company loses control of internal files, the information inside often includes names, addresses, dates of birth, Social Security numbers, insurance details, and medical billing records. If your hospital used Resource Corporation of America to chase Medicaid, charity-care, or third-party payments, your family’s protected health information may now sit on a ransomware server. Medical data sells for far more than simple login credentials on the underground market and can be used to file fraudulent tax returns, open accounts in your name, or pressure you with threats of exposing sensitive diagnoses.

Even if you never directly hired the firm, the hospitals and clinics you trust likely did. That means one breach can ripple outward and put thousands of patient families at risk without any obvious warning.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at dumping raw files. They map relationships between leaked emails, employee usernames, patient identifiers, and external accounts. A single exposed hospital billing email can link to your personal Gmail, then to your children’s gaming logins, then to home addresses and phone numbers. These identity chains let attackers move from financial fraud to full doxxing—publishing your family’s details on forums or using them for targeted phishing and SIM-swapping attacks. Credential leaks like this one routinely cascade into account takeovers precisely because people reuse passwords across work, personal, and gaming services.

Medusa’s Publicly Known Track Record

Public reporting attributes Medusa with emerging in 2021 and maintaining a double-extortion model: encrypt victim systems, then threaten to publish stolen data unless a ransom is paid. The group has listed hundreds of organizations across multiple industries, with a focus on mid-sized firms whose disruption creates pressure to pay quickly. Their typical playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by exfiltration of sensitive files over several weeks before deploying ransomware. They maintain an active leak site to prove possession and set short payment deadlines, often giving victims only days before full data publication.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you ever used at Resource Corporation of America or the hospitals it served, then enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which frequently become the next link in doxxing chains after healthcare leaks.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with threat actors yourself.

The Medusa listing of Resource Corporation of America is a reminder that healthcare-adjacent vendors can expose your family’s most sensitive records without any direct relationship on your part. Taking concrete steps now limits what attackers can build from this claimed breach. Start your DoxxScan trial for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes your children’s gaming accounts.