Resource Corporation of America Data Breach Exposes PHI and PII

Resource Corporation of America (RCA), a Texas-based healthcare revenue cycle and reimbursement solutions provider, has experienced a data breach affecting sensitive personal and health information.

The incident was discovered on Dec. 17, 2025, after the company detected suspicious activity within certain computer systems. An investigation, supported by external cybersecurity specialists, revealed that unauthorized actors accessed and copied files from RCA’s systems between Dec. 9 and Dec. 17, 2025.

The breach was the result of a ransomware attack carried out by the MEDUSA group, who claimed responsibility and threatened to publish the stolen data on the dark web if their demands were not met. MEDUSA posted about the attack on Jan. 4, 2026, on their Tor network site, stating they had obtained internal data and would release it within 15 to 16 days.

The information exposed in this breach includes both personally identifiable information (PII) and protected health information (PHI). The copied files may contain names, addresses, dates of birth, Social Security numbers, health insurance details, and medical diagnosis and treatment information.

The incident was disclosed to the public on the company's website.

Resource Corporation of America's response

Upon discovering the breach, Resource Corporation of America secured its systems and launched a comprehensive investigation with the help of cybersecurity experts. RCA has also taken steps to enhance its data protection policies and security measures to help prevent similar incidents in the future.

Affected individuals are advised to:

• Review account statements and explanation of benefits for suspicious activity
• Monitor their credit reports for errors or unauthorized activity
• Consider placing a fraud alert or credit freeze with major credit bureaus

RCA has established a dedicated toll-free number, 844-726-0950, available Monday through Friday from 9 a.m. to 5 p.m. Central time, for individuals seeking more information about the breach.