In August 2023, McLaren Health Care, a Michigan-based healthcare provider, experienced a data breach perpetrated by the ransomware group Alphv/BlackCat. The attackers threatened to release sensitive personal and health information of millions of patients on the dark web unless a ransom was paid. This incident raised concerns about the security measures in place to protect sensitive data and the potential consequences for affected individuals.

How many accounts were compromised?

The breach impacted data related to approximately 2.5 million individuals.

What data was leaked?

The data exposed in the breach included sensitive personal and health information, such as names, Social Security numbers, health insurance details, dates of birth, medical records, billing or claims information, diagnosis, physician information, Medicare/Medicaid information, prescription/medication information, and diagnostic and treatment information.

How was McLaren hacked?

The cybercriminal gang ALPHV/BlackCat infiltrated McLaren Health Care's computer systems and stole sensitive personal health information of millions of patients. They used ransomware to disable the company's network and extracted data before encrypting it. The specific methods employed by the hackers remain unclear.

McLaren's solution

In response to the hacking incident, McLaren Health Care took several measures to enhance its security and prevent future breaches. The healthcare provider acknowledged the ransomware attack and retained security experts while collaborating with law enforcement. Although specific details about the removal of malware and backdoors or the implementation of enhanced security protocols remain unclear, McLaren moved quickly to investigate and respond to the incident. They assessed the security of their systems, identified potentially affected individuals, and notified federal law enforcement.

How do I know if I was affected?

McLaren Health Care notified individuals believed to be affected by the breach. If you are a McLaren patient and have not received a notification, you may visit Have I Been Pwned to check your credentials.

What should affected users do?

In general, affected users should:

• Change Your Passwords: Immediately update your passwords for any accounts that may have been compromised. Make sure the new passwords are strong and unique, not previously used on any other platform.

• Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

• Enable Two-Factor Authentication (2FA): Activate 2FA on any affected accounts. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

• Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report it immediately to the appropriate authorities or service providers.

For more specific help and instructions related to McLaren's data breach, please contact McLaren's support directly.

Where can I go to learn more?

If you want to find more information on the McLaren data breach, check out the following news articles:

• AG Nessel Notifies Michigan Residents of McLaren Ransomware Attack Threatening to Expose Patient Data

• PRIVACY ALERT: McLaren Health Care Under Investigation for Data Breach of 2.2 Million Patient Records

• McLaren Health Care data breach impacts millions