McLaren Health Care confirms ransomware attack claimed by ALPHV/BlackCat

McLaren Health Care, a Grand Blanc, Michigan health system that operates 14 hospitals, confirmed in early October 2023 that it had been hit by ransomware. The organization said it detected suspicious activity on its network in late August and brought in outside cybersecurity specialists, who determined an intruder had access to its environment between late July and August 23, 2023.

The ALPHV/BlackCat group listed McLaren on its dark web leak site on September 29 and claimed to have taken more than six terabytes of data covering roughly 2.5 million patients. The gang also said it retained a backdoor into McLaren's network. McLaren disputed that, saying its specialists found no evidence the group still had access.

McLaren said its systems remained operational and that it continued to provide care. According to Healthcare Dive, citing Detroit Free Press reporting, billing systems and the electronic health record were affected after the security team shut down parts of the network in response to the intrusion.

The health system reported the breach to the U.S. Department of Health and Human Services in October and told the Maine Attorney General in November that 2,192,515 individuals were affected, below the attackers' claim. The total was later revised with the HHS Office for Civil Rights to 2,103,881, on a date the sources do not give. The data involved included names, Social Security numbers, health condition information and healthcare payment details. Notifications to affected patients began in November 2023, and the attackers said they would auction the data rather than publish it.