Settlements Reached in Data Breach Lawsuits Against McKenzie Health System and Aspire Health Alliance
Two healthcare providers McKenzie Health System in Michigan and Aspire Health Alliance in Massachusetts have settled class action lawsuits stemming from separate cyberattacks that exposed sensitive patient data.
McKenzie Health System Breach (April 2025)
McKenzie Health System, operator of McKenzie Memorial Hospital in Sanilac County, Michigan, detected unauthorized network access on April 15, 2025, following a cyberattack that occurred between April 14–15, 2025. The breach potentially compromised files containing names, addresses, birth dates, Social Security numbers, medical record numbers, diagnosis and treatment details, and other sensitive information. The incident affected 58,839 individuals, with notifications sent starting July 24, 2025.
Multiple lawsuits were consolidated into a single case In Re: McKenzie Memorial Hospital d/b/a McKenzie Health System 2025 Data Breach Litigation in the Sanilac County Circuit Court. Plaintiffs alleged negligence in preventing the breach. While McKenzie Health denies wrongdoing, it agreed to a settlement to avoid prolonged litigation.
Under the terms, affected individuals can receive:
- Two years of credit monitoring and identity theft protection
- Reimbursement of up to $4,000 for documented losses or a $50 cash payment
The deadline for claims, objections, or opting out is August 24, 2026, with a final fairness hearing set for October 6, 2026.
Aspire Health Alliance Breach (September 2023)
Aspire Health Alliance, a behavioral health provider in Quincy, Braintree, and Marshfield, Massachusetts, detected unauthorized network access on September 13, 2023. The breach exposed names, birth dates, treatment details, insurance information, and Medicare/Medicaid numbers of 17,490 individuals, with notifications beginning April 26, 2024.
A class action lawsuit Joan Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance was filed in Norfolk County Superior Court (later moved to Suffolk County) alleging negligence in cybersecurity measures. Aspire Health denies liability but settled to avoid further legal costs.
The settlement includes a $400,000 fund covering:
- One year of medical data monitoring (CyEx Medical Shield)
- Reimbursement of up to $2,500 for documented losses or a pro rata cash payment
The deadline for claims, objections, or opting out is September 16, 2026, with a final fairness hearing on October 1, 2026.
Both settlements resolve litigation without admission of fault, providing affected individuals with compensation and monitoring services.
Source: https://www.hipaajournal.com/mckenzie-health-system-aspire-health-alliance-data-breach-settlements/
Aspire Health Alliance cybersecurity rating report: https://www.rankiteo.com/company/aspire-health-alliance
McKenzie Health System cybersecurity rating report: https://www.rankiteo.com/company/mckenzie-health-system
"id": "ASPMCK1786019588",
"linkid": "aspire-health-alliance, mckenzie-health-system",
"type": "Breach",
"date": "4/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '58,839',
'industry': 'Healthcare',
'location': 'Sanilac County, Michigan, USA',
'name': 'McKenzie Health System',
'type': 'Healthcare Provider'},
{'customers_affected': '17,490',
'industry': 'Healthcare',
'location': 'Quincy, Braintree, and Marshfield, '
'Massachusetts, USA',
'name': 'Aspire Health Alliance',
'type': 'Behavioral Health Provider'}],
'customer_advisories': 'Notifications sent to affected individuals with '
'settlement details',
'data_breach': {'number_of_records_exposed': ['58,839', '17,490'],
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Addresses',
'Birth dates',
'Social Security numbers',
'Medical record numbers',
'Diagnosis and treatment details',
'Insurance information',
'Medicare/Medicaid numbers']},
'date_detected': ['2025-04-15', '2023-09-13'],
'date_publicly_disclosed': ['2025-07-24', '2024-04-26'],
'description': 'Two healthcare providers McKenzie Health System in Michigan '
'and Aspire Health Alliance in Massachusetts have settled '
'class action lawsuits stemming from separate cyberattacks '
'that exposed sensitive patient data.',
'impact': {'data_compromised': 'Sensitive patient data including names, '
'addresses, birth dates, Social Security '
'numbers, medical record numbers, diagnosis '
'and treatment details, insurance information, '
'and Medicare/Medicaid numbers',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuits settled'},
'investigation_status': 'Settled',
'references': [{'source': 'Class action lawsuit settlement details'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuits settled'},
'response': {'communication_strategy': 'Notifications sent to affected '
'individuals'},
'title': 'Settlements Reached in Data Breach Lawsuits Against McKenzie Health '
'System and Aspire Health Alliance',
'type': 'Data Breach'}