Resource Corporation of America Data Breach 2026 (Medusa + Qilin Double Extortion): 70 GB of Uninsured-Patient Eligibility Records Leaked. What To Do

What happened

Resource Corporation of America (RCA) is a Texas-based revenue cycle management vendor headquartered at 1120 Marina Bay Drive, Clear Lake Shores. RCA specializes in third-party eligibility / enrollment for hospitals — screening uninsured and self-pay patients into Medicaid, SSI/SSDI, charity care, COBRA, and ACA coverage programs. The company claims a ~93% certification success rate and operates a national footprint. As a vendor handling patient PHI on behalf of hospital clients, RCA is a HIPAA business associate.

The data RCA holds by function is particularly sensitive: SSN, DOB, address, household income, household composition, Medicaid IDs, insurance info, and medical diagnosis / treatment — because eligibility screening requires verifying financial hardship and medical condition.

Between December 9 and 17, 2025, an unauthorized actor accessed RCA’s network and exfiltrated files. RCA discovered the intrusion on December 17, 2025 and notified federal law enforcement the same day.

This is one of the rare double-extortion incidents claimed by two separate ransomware groups:

• January 4, 2026: Medusa posted RCA on its dark-web leak site with ~30 sample documents and demanded $800,000 ransom
• January 12, 2026: Qilin separately claimed RCA on its leak site

Two distinct claims suggest either an initial-access-broker handoff (Medusa bought the foothold from someone who also sold to Qilin) or two independent intrusions during the same compromise window. Either way, two threat groups now hold RCA’s data.

On January 20, 2026, after RCA refused to pay, Medusa published the ~70 GB archive publicly. Medusa’s statement: “The company begged us for a long time…but we refused.”

RCA filed with HHS OCR on February 13, 2026 at the 501-individual reporting floor, with explicit language that “this review process is currently ongoing, and RCA will supplement this notice upon completion of the review.” Given the 70 GB exfiltration volume and the eligibility-vendor scale across multiple hospital clients, the final affected count is almost certainly 5-6 figures or higher.

Downstream hospital clients affected

RCA serves hospitals nationwide as a business associate, but no specific hospital client has been publicly named as a downstream covered entity in this breach. Medusa’s leak archive likely contains identifiable client information in document metadata and contents. Expect separate OCR filings from downstream hospital clients to surface over the coming weeks as those covered entities receive the data and complete their own notifications.

If you were screened by RCA at a hospital admission (any uninsured / charity-care / Medicaid enrollment process during an ER visit, inpatient stay, or outpatient procedure), your records were potentially handled by RCA.

What was stolen

Per RCA’s notice (officially confirmed):

• Full name, home address
• Date of birth
• Social Security number
• Health insurance information
• Medical diagnosis and treatment information
• Benefits eligibility data

Inferred from RCA’s eligibility-vendor function (not enumerated in the entity notice but typical for this workflow):

• Income documents (paystubs, tax returns)
• Household composition (family members and dependents)
• Medicaid application data
• Financial-hardship attestations

What RCA is offering

• Systems secured; external cybersecurity specialists engaged; federal law enforcement notified
• Toll-free call center: 844-726-0950 (Monday to Friday, 9 a.m. to 5 p.m. Central)
• Mailing address for inquiries: 1120 Marina Bay Drive, Clear Lake Shores, TX 77565

RCA’s notice does NOT offer complimentary credit monitoring or identity theft protection — patients are directed to self-help fraud alerts and credit freezes. This is unusual given the SSN exposure and the 70 GB public leak, and is likely a focal point of class-action litigation.

A particularly vulnerable population

RCA’s patient population is by definition uninsured or under-insured low-income hospital patients — the people screened for charity care, Medicaid, or ACA enrollment because they couldn’t afford their hospital bill. For this population:

• No existing credit monitoring infrastructure — many patients won’t have access to a credit-freeze workflow without help
• Mixed-status families may face immigration-enforcement exposure from SSN data combined with household-composition records
• Medicaid enrollment fraud — claims billed under your member ID can disrupt your benefits eligibility
• Income document exposure creates risk of targeted financial scams referencing real income figures

What to do

1. Read your specific notification letter — if you received eligibility screening at any hospital in 2024-2025 and got a letter mentioning Resource Corporation of America, your records are in scope.
2. Place free credit freezes at Equifax, Experian, TransUnion. RCA is NOT providing monitoring. Freezes are free at all three bureaus.
3. File IRS Form 14039. Full SSN is in scope and has been publicly leaked.
4. Get free annual credit reports at annualcreditreport.com and check monthly via your bank or card issuer’s free monitoring.
5. Watch your Medicaid Notice of Action statements for unfamiliar claims and call your state Medicaid Member Services if you see anything unauthorized.
6. If you are a mixed-status family with household-composition records potentially exposed, consider consulting NILC, ACLU, or your local immigrant legal services organization.
7. Stop the ongoing flow of your eligibility-screening data. HealthConsent files HIPAA restriction requests covering revenue cycle management and uninsured-patient enrollment vendor pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches