The IT Nerd

McLaren Health Care is warning 743,000 patients that the health system suffered a data breach caused by a July 2024 attack by the INC ransomware gang:

Although the attack was discovered on August 5, 2024, forensic investigations determining who was impacted were only completed on May 5, 2025, with the notice circulation starting last Friday.

And:

In early August 2024, the healthcare organization suffered an IT and phone systems outage that prompted investigations. Patient databases were reported impacted, and people were asked to bring information about appointments and medication when visiting McLaren hospitals.

Even though the organization did not specify who the attackers were, an employee at one of McLaren’s hospitals in Bay City, Michigan, posted INC ransom notes online that were automatically printed on the hospital’s printers.

In the notice sent to impacted individuals, McLaren Health Care admits that the incident concerned a ransomware attack, though INC is still not mentioned.

Chris Hauk, Consumer Privacy Champion at Pixel Privacy had this to say:

“Patients of the McLaren Health Care system need to stay alert for both accounts being opened in their names and for phishing texts or emails that may use the harvested data to obtain additional information. If McLaren offers free credit monitoring services (and there is no reason not to do so), affected patients should definitely take advantage of it.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech provided this comment: 

“McLaren has not publicly disclosed what types of data were compromised in the attack, but patients and staff should take steps to protect their finances and identities. Check your credit reports, account statements, and medical bills for signs of fraud. If McLaren offers you free credit monitoring or identity theft monitoring, then take it.”

“McLaren is the latest in a long list of targets hacked by Inc Ransomware, many of which are hospitals and clinics. Inc has also launched successful attacks against Access Sports Medicine and Orthopaedics, OnePoint Patient Care, Taylor Regional Hospital, and Tri-City Medical Center, plus many more in the last year alone.”

“Hospitals and clinics are attractive targets for ransomware gangs. Hospitals cannot go long without access to medical records and other data, and they hold a lot of sensitive information. That makes them more likely to pay a ransom.  They also have a lot of non-IT staff and internet-facing services, which give hackers more opportunities to break in through phishing and software vulnerabilities.”

Erich Kron, Security Awareness Advocate at KnowBe4 adds this: 

“Healthcare is one of the top industries to be targeted by bad actors for not only ransomware, but also data theft. The data that these organizations collect and the information they have related to individuals is significant and very sensitive, so when we hear about a data breach like this, we should certainly be taking notice, especially if you are a customer or patient.”

“What is very concerning is that the attack was discovered in August of 2024, but it seems the real victims, those whose data was stolen and potentially put up for sale, have not been informed until now. A delay in informing patients about their potential risk and exposure could end up costing those victims more than just frustration. Bad actors in possession of this information can easily develop social engineering attacks that use this data to make them seem very legitimate, and potential victims should be warned of this possibility as soon as possible.”

“For those whose data has been stolen, it’s important that they monitor their credit and be aware of the potential for increased numbers of scams and other social engineering attacks.”

“Organizations that handle sensitive information such as this should have a plan in place to quickly deal with the issue and to warn anyone potentially impacted as soon as possible. It’s not just how quickly you recover from something like this, but how quickly you help your customers and patients protect themselves.”

On top of the fact that this is yet another health care organization that has been pwned, it took an insane amount of time to notify those who are affected. That gives the bad guys a huge head start in terms of doing all sorts of bad things with the data that they stole. That means that the victims are not going to have a happy ending on with this one.

Ransomware group Play yesterday took credit for last week’s cyber attack on Dairy Farmers of America which disrupted multiple dairy manufacturing plants in the USA’s largest dairy cooperative.

Play said it stole confidential data including budget, payroll, accounting, taxes, and financial info from the DFA. Play gave the DFA three days to pay an undisclosed amount in ransom.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Play is a ransomware group that has targeted organizations in healthcare finance, manufacturing, real estate, education, and more since June 2022. Its double-extortion model forces targets to pay a ransom both for a decryption key to restore infected systems and to not sell or publicly release stolen data. Play has taken credit for 152 confirmed ransomware attacks since it began, compromising nearly 1.4 million records.”

“15 of its attacks hit businesses in the food and beverage industry. Those include recent attacks on Krispy Kreme, which notified 161,676 people of a November 2024 breach, and Ganong Bros, which reported a breach in February 2025. Krispy Kreme says it lost $11 million in revenue and spent $3 million on remediation due to Play’s attack. Play has claimed 11 confirmed attacks and made 193 unconfirmed claims since the start of 2025.”

“Ransomware attacks on food and beverage companies can both steal data and lock down computer systems. Businesses are forced to pay a ransom or face extended downtime, data loss, and putting customers at increased risk of fraud. Ransomware attacks can delay and disrupt supply chains, logistics, payments, orders, and other day-to-day tasks that rely on computer software.”

These guys sound like they are going to be the next ransomware group that we will have to really worry about as they sound like they are really going to town on victims. Thus consider this a warning to shore up your defences to make sure that you are not their next victim.