OneSource Medical Group listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Healthcare
• Announcement date: March 7, 2026

Genesis ransomware group claims data theft from OneSource Medical Group

The threat group known as Genesis has listed OneSource Medical Group on its leak site, claiming to possess 100 GB of data stolen from the organization. This announcement, which appeared on March 7, 2026, indicates that the group has obtained data from the organization's systems and has expressed an intention to release the information publicly.

The group's specific identity and background remain limited, as information regarding this group is currently scarce. In such scenarios, ransomware leak sites serve as a platform for threat actors to exert pressure on victims. These sites are often used to host stolen data or announcements regarding upcoming leaks, frequently as part of a broader extortion strategy designed to coerce organizations into paying ransoms.

Details of the claimed data breach

According to the announcement made by the Genesis group, the volume of the compromised data is estimated at 100 GB. While the specific file count and the exact ransom demand have not been disclosed by the group, the claims regarding the contents of the data are extensive. The group asserts that the stolen information includes a wide variety of sensitive categories that could impact both the organization and its clients.

The data types allegedly included in the leak are as follows:

• Customer PII
• Insurance data
• Healthcare records
• Billing information
• Financial data
• Operational data

The presence of such diverse data types suggests a significant breach of information, ranging from individual identity markers to the internal operational mechanics of the company.

About OneSource Medical Group

OneSource Medical Group is a company that provides revenue cycle management (RCM) and billing services for healthcare organizations. Because their business model revolves around managing the financial and administrative aspects of medical care, they handle a high volume of sensitive information related to patients, providers, and financial transactions.

Implications and industry risks

These claims suggest that sensitive data belonging to the healthcare provider may be at risk. Because the organization is based in the United States, the potential for data breach notification requirements and legal penalties under HIPAA regulations may apply. The exposure of customer personal and health information could create significant risks for identity theft and targeted phishing attacks, as attackers often use such data to craft convincing fraudulent communications.

Furthermore, the leakage of operational data may lead to secondary risks affecting the organization's business operations. The group's method may be intended to increase pressure on the organization through a double-extortion strategy. In a double-extortion scenario, attackers do not just encrypt systems to disrupt operations; they also steal sensitive data to threaten the victim with its public release, thereby increasing the leverage they hold during negotiations.

For organizations operating within the healthcare sector, these types of incidents highlight the critical importance of robust defensive measures. Common defensive steps often include implementing multi-factor authentication, maintaining strict access controls, and ensuring comprehensive encryption for data both at rest and in transit. Additionally, regular monitoring of network traffic and maintaining offline, immutable backups are essential components of a resilient cybersecurity posture designed to mitigate the impact of such targeted attacks.