McLaren Health Care is warning 743,000 patients that the health system suffered a data breach caused by a July 2024 attack by the INC ransomware gang.
Although the attack was discovered on August 5, 2024, forensic investigations determining who was impacted were only completed on May 5, 2025, with the notice circulation starting last Friday.
McLaren is a nonprofit health system in the U.S. with $6.6 billion in annual revenue, operating a network that spans 14 Michigan hospitals (2,624 beds). It employs 490 physicians and 28,000 full-time staff while contracting with another 113,000 providers across Michigan and into Indiana.
In early August 2024, the healthcare organization suffered an IT and phone systems outage that prompted investigations. Patient databases were reported impacted, and people were asked to bring information about appointments and medication when visiting McLaren hospitals.
Even though the organization did not specify who the attackers were, an employee at one of McLaren's hospitals in Bay City, Michigan, posted INC ransom notes online that were automatically printed on the hospital's printers.
Alleged McLaren ransom note
Source: Thomas Barz
In the notice sent to impacted individuals, McLaren Health Care admits that the incident concerned a ransomware attack, though INC is still not mentioned.
"Our organization was the target of a cybersecurity attack by an international ransomware group that impacted the McLaren Health Care and Karmanos Cancer Institute computer network," reads the notice.
The investigation determined that the attackers maintained access to McLaren's and Karmanos' systems between July 17, 2024, and August 3, 2024.
... continue reading