Resource Corporation of America Healthcare Eligibility Services Breach (2025): 809K Records Including SSN Exposed via Medusa Ransomware

About Resource Corporation of America

Resource Corporation of America (RCA) is a U.S. business-process outsourcing firm providing third-party eligibility, enrollment, and revenue-cycle services to healthcare organizations. Operating on behalf of provider and payer clients, it handles patient and applicant administrative records, contact details, and financial and benefits-eligibility information as part of its eligibility and collections workflows.

Why They Hold Your Data

Receivables management and BPO firms collect debtor, client, and contact records, often including names, addresses, phone numbers, account references, and financial obligation data tied to collections workflows.

Recent Developments

RCA disclosed the incident in early 2026 after detecting suspicious activity in December 2025. The Medusa ransomware group claimed responsibility, posting on its Tor site on January 4, 2026 and threatening to release the data. Multiple class-action firms have opened investigations.

Data Points Exposed

Breach Impact

As a healthcare BPO, RCA holds identity and health-eligibility data for large numbers of individuals across its client base, so exposure of names, Social Security numbers, and contact details creates broad identity-theft and fraud risk, amplified by the third-party nature of the breach (affected individuals are its clients' patients). RCA's notice indicated dates of birth, health insurance, and medical diagnosis/treatment information could also be involved, which would materially increase medical-fraud and extortion risk.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using SSN | • Targeted phishing and vishing using name, email, and phone | • Debt-collection and eligibility-themed impersonation scams | • SIM swap attacks where phone numbers are present | • Potential medical-fraud and extortion if reported health data is in the dump

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).