Michigan healthcare provider McLaren Health Care is notifying over 743,000 people that their personal information was compromised in a 2024 data breach.
The incident, the organization says, was discovered on August 5, 2024, after suspicious activity was identified on computer systems pertaining to McLaren and Karmanos Cancer Institute.
In a written notification to the impacted individuals, a copy of which was submitted to the Maine Attorney General’s Office, McLaren revealed that ransomware was involved in the attack.
The hackers had access to its network between July 17 and August 3, and obtained various files containing sensitive data, including personally identifiable information (PII) and protected health information (PHI).
The potentially compromised information, the organization says, includes names, Social Security numbers, driver’s license numbers, health insurance details, and medical information.
McLaren notified the Maine AGO that 743,131 individuals were impacted by the data breach and that it is providing them with 12 months of free credit monitoring services, as well as with guidance on how to protect themselves against fraud and identity theft.
The healthcare provider did not name the threat actor responsible for the incident and SecurityWeek has not seen any known ransomware groups claiming the attack.
This is the second data breach resulting from a ransomware attack that McLaren Health Care has disclosed over the past two years.
In November 2023, the organization announced that 2.2 million people were affected by a data breach after the Alphv/BlackCat ransomware group breached its network in July 2023.
Headquartered in Grand Blanc, Michigan, McLaren Health Care is a fully integrated healthcare delivery system that includes 15 hospitals. In 2013, it signed an agreement with Karmanos Cancer Institute, creating the largest cancer research and provider network in the state.
