Resource Corporation of America 2025 Data Breach
Company · Business process outsourcing and receivables management · Financial services provider · USA
Resource Corporation of America Healthcare Eligibility Services Breach (2025): 809K Records Including SSN Exposed via Medusa Ransomware
Healthcare eligibility and revenue-cycle services provider (business process outsourcing).
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Resource Corporation of America detected suspicious activity on December 17, 2025 and determined an unauthorized actor accessed its systems and copied files between December 9 and 17, 2025. The Medusa ransomware group claimed the attack, posting on January 4, 2026 that it had obtained internal data and would release it within about 15-16 days. RCA's notice stated the potentially affected data could include names, addresses, dates of birth, Social Security numbers, health insurance details, and medical diagnosis/treatment information, though it was still reviewing files and reported no confirmed misuse. Confirmed circulating identifiers center on names, Social Security numbers, and contact data; the health-related categories remain RCA-reported and not independently confirmed in circulation. Approximately 809,233 individuals are recorded (per DataBreach.com).
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
809K records analyzed
About Resource Corporation of America
Resource Corporation of America (RCA) is a U.S. business-process outsourcing firm providing third-party eligibility, enrollment, and revenue-cycle services to healthcare organizations. Operating on behalf of provider and payer clients, it handles patient and applicant administrative records, contact details, and financial and benefits-eligibility information as part of its eligibility and collections workflows.
Why They Hold Your Data
Receivables management and BPO firms collect debtor, client, and contact records, often including names, addresses, phone numbers, account references, and financial obligation data tied to collections workflows.
Recent Developments
RCA disclosed the incident in early 2026 after detecting suspicious activity in December 2025. The Medusa ransomware group claimed responsibility, posting on its Tor site on January 4, 2026 and threatening to release the data. Multiple class-action firms have opened investigations.
Data Points Exposed
Breach Impact
As a healthcare BPO, RCA holds identity and health-eligibility data for large numbers of individuals across its client base, so exposure of names, Social Security numbers, and contact details creates broad identity-theft and fraud risk, amplified by the third-party nature of the breach (affected individuals are its clients' patients). RCA's notice indicated dates of birth, health insurance, and medical diagnosis/treatment information could also be involved, which would materially increase medical-fraud and extortion risk.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using SSN | • Targeted phishing and vishing using name, email, and phone | • Debt-collection and eligibility-themed impersonation scams | • SIM swap attacks where phone numbers are present | • Potential medical-fraud and extortion if reported health data is in the dump
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Motivation: Financial extortion
A RaaS operation prominent through 2023-2025 that pressures victims with double extortion, threatening public data release. Hits healthcare, education, technology, manufacturing, legal and government.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation