Data of more than 740,000 stolen in ransomware attack on Michigan hospital network

Ransomware hackers stole the Social Security numbers and health insurance information for more than 740,000 people during an attack on a prominent Michigan hospital network. 

McLaren Health Care filed documents on Friday concerning a ransomware attack that took place in August 2024 — the second cyber incident to impact the healthcare giant in 12 months. 

The attack last year was launched by an “international ransomware group” and impacted the computer networks of both McLaren Health Care and Karmanos Cancer Institute, the documents said. McLaren did not offer further details about the cybercriminals. 

Letters to victims said the suspicious activity was discovered on August 5 and investigators found the hackers initially gained access as far back as July 17. A forensic review completed last month found that 743,131 people had information stolen.

The breached data also included names, driver’s license numbers and medical information, the network said. Victims are being given one year of credit monitoring services. 

McLaren Health Care — which operates 13 hospitals across Michigan, as well as other medical services such as infusion centers, cancer centers, primary and specialty care offices and a clinical laboratory network — warned the public at the time that it was forced to operate with downtime procedures while working to restore several downed IT systems. 

McLaren emergency departments continued to operate but some surgeries and procedures were canceled as a result of the attack. Some non-emergent appointments, tests and treatments were rescheduled, according to the statement. 

The organization did not call it a ransomware attack at the time, but a printed ransom note from the INC ransomware gang allegedly sent to the hospital was shared on social media.  

The same hospital system was attacked 11 months earlier by the now-defunct AlphV ransomware gang in an incident the organization said impacted 2.1 million people.