McLaren Health Care is warning 743,000 patients that the health system suffered a data breach caused by a July 2024 attack by the INC ransomware gang:
Although the attack was discovered on August 5, 2024, forensic investigations determining who was impacted were only completed on May 5, 2025, with the notice circulation starting last Friday.
And:
In early August 2024, the healthcare organization suffered an IT and phone systems outage that prompted investigations. Patient databases were reported impacted, and people were asked to bring information about appointments and medication when visiting McLaren hospitals.
Even though the organization did not specify who the attackers were, an employee at one of McLaren’s hospitals in Bay City, Michigan, posted INC ransom notes online that were automatically printed on the hospital’s printers.
In the notice sent to impacted individuals, McLaren Health Care admits that the incident concerned a ransomware attack, though INC is still not mentioned.
Chris Hauk, Consumer Privacy Champion at Pixel Privacy had this to say:
“Patients of the McLaren Health Care system need to stay alert for both accounts being opened in their names and for phishing texts or emails that may use the harvested data to obtain additional information. If McLaren offers free credit monitoring services (and there is no reason not to do so), affected patients should definitely take advantage of it.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech provided this comment:
“McLaren has not publicly disclosed what types of data were compromised in the attack, but patients and staff should take steps to protect their finances and identities. Check your credit reports, account statements, and medical bills for signs of fraud. If McLaren offers you free credit monitoring or identity theft monitoring, then take it.”
“McLaren is the latest in a long list of targets hacked by Inc Ransomware, many of which are hospitals and clinics. Inc has also launched successful attacks against Access Sports Medicine and Orthopaedics, OnePoint Patient Care, Taylor Regional Hospital, and Tri-City Medical Center, plus many more in the last year alone.”
“Hospitals and clinics are attractive targets for ransomware gangs. Hospitals cannot go long without access to medical records and other data, and they hold a lot of sensitive information. That makes them more likely to pay a ransom. They also have a lot of non-IT staff and internet-facing services, which give hackers more opportunities to break in through phishing and software vulnerabilities.”
Erich Kron, Security Awareness Advocate at KnowBe4 adds this:
“Healthcare is one of the top industries to be targeted by bad actors for not only ransomware, but also data theft. The data that these organizations collect and the information they have related to individuals is significant and very sensitive, so when we hear about a data breach like this, we should certainly be taking notice, especially if you are a customer or patient.”
“What is very concerning is that the attack was discovered in August of 2024, but it seems the real victims, those whose data was stolen and potentially put up for sale, have not been informed until now. A delay in informing patients about their potential risk and exposure could end up costing those victims more than just frustration. Bad actors in possession of this information can easily develop social engineering attacks that use this data to make them seem very legitimate, and potential victims should be warned of this possibility as soon as possible.”
“For those whose data has been stolen, it’s important that they monitor their credit and be aware of the potential for increased numbers of scams and other social engineering attacks.”
“Organizations that handle sensitive information such as this should have a plan in place to quickly deal with the issue and to warn anyone potentially impacted as soon as possible. It’s not just how quickly you recover from something like this, but how quickly you help your customers and patients protect themselves.”
On top of the fact that this is yet another health care organization that has been pwned, it took an insane amount of time to notify those who are affected. That gives the bad guys a huge head start in terms of doing all sorts of bad things with the data that they stole. That means that the victims are not going to have a happy ending on with this one.
McLaren Health Care Pwned…. 743,000 Patients Impacted
Posted in Commentary with tags Hacked on June 23, 2025 by itnerdMcLaren Health Care is warning 743,000 patients that the health system suffered a data breach caused by a July 2024 attack by the INC ransomware gang:
Although the attack was discovered on August 5, 2024, forensic investigations determining who was impacted were only completed on May 5, 2025, with the notice circulation starting last Friday.
And:
In early August 2024, the healthcare organization suffered an IT and phone systems outage that prompted investigations. Patient databases were reported impacted, and people were asked to bring information about appointments and medication when visiting McLaren hospitals.
Even though the organization did not specify who the attackers were, an employee at one of McLaren’s hospitals in Bay City, Michigan, posted INC ransom notes online that were automatically printed on the hospital’s printers.
In the notice sent to impacted individuals, McLaren Health Care admits that the incident concerned a ransomware attack, though INC is still not mentioned.
Chris Hauk, Consumer Privacy Champion at Pixel Privacy had this to say:
“Patients of the McLaren Health Care system need to stay alert for both accounts being opened in their names and for phishing texts or emails that may use the harvested data to obtain additional information. If McLaren offers free credit monitoring services (and there is no reason not to do so), affected patients should definitely take advantage of it.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech provided this comment:
“McLaren has not publicly disclosed what types of data were compromised in the attack, but patients and staff should take steps to protect their finances and identities. Check your credit reports, account statements, and medical bills for signs of fraud. If McLaren offers you free credit monitoring or identity theft monitoring, then take it.”
“McLaren is the latest in a long list of targets hacked by Inc Ransomware, many of which are hospitals and clinics. Inc has also launched successful attacks against Access Sports Medicine and Orthopaedics, OnePoint Patient Care, Taylor Regional Hospital, and Tri-City Medical Center, plus many more in the last year alone.”
“Hospitals and clinics are attractive targets for ransomware gangs. Hospitals cannot go long without access to medical records and other data, and they hold a lot of sensitive information. That makes them more likely to pay a ransom. They also have a lot of non-IT staff and internet-facing services, which give hackers more opportunities to break in through phishing and software vulnerabilities.”
Erich Kron, Security Awareness Advocate at KnowBe4 adds this:
“Healthcare is one of the top industries to be targeted by bad actors for not only ransomware, but also data theft. The data that these organizations collect and the information they have related to individuals is significant and very sensitive, so when we hear about a data breach like this, we should certainly be taking notice, especially if you are a customer or patient.”
“What is very concerning is that the attack was discovered in August of 2024, but it seems the real victims, those whose data was stolen and potentially put up for sale, have not been informed until now. A delay in informing patients about their potential risk and exposure could end up costing those victims more than just frustration. Bad actors in possession of this information can easily develop social engineering attacks that use this data to make them seem very legitimate, and potential victims should be warned of this possibility as soon as possible.”
“For those whose data has been stolen, it’s important that they monitor their credit and be aware of the potential for increased numbers of scams and other social engineering attacks.”
“Organizations that handle sensitive information such as this should have a plan in place to quickly deal with the issue and to warn anyone potentially impacted as soon as possible. It’s not just how quickly you recover from something like this, but how quickly you help your customers and patients protect themselves.”
On top of the fact that this is yet another health care organization that has been pwned, it took an insane amount of time to notify those who are affected. That gives the bad guys a huge head start in terms of doing all sorts of bad things with the data that they stole. That means that the victims are not going to have a happy ending on with this one.
Leave a comment »