McLaren Health Care

McLaren Health Care suffered a data breach in July 2024 caused by the INC ransomware gang, impacting 743,000 patients. The attack was discovered on August 5, 2024, but forensic investigations were completed on May 5, 2025. The breach involved an IT and phone systems outage, affecting patient databases. Full names were exposed, but the full extent of the data breach remains unclear. This is the second major breach for McLaren, with the previous one in July 2023 by the ALPHV/BlackCat ransomware group affecting 2.2 million people.

Source: https://www.bleepingcomputer.com/news/security/mclaren-health-care-says-data-breach-impacts-743-000-patients/

TPRM report: https://scoringcyber.rankiteo.com/company/mclaren-health-care

"id": "mcl601062325",
"linkid": "mclaren-health-care",
"type": "Ransomware",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '743,000 patients',
                        'industry': 'Healthcare',
                        'location': 'Michigan, USA',
                        'name': 'McLaren Health Care',
                        'size': '28,000 full-time staff',
                        'type': 'Healthcare system'}],
 'attack_vector': 'Unspecified',
 'customer_advisories': 'Notice sent to impacted individuals',
 'data_breach': {'number_of_records_exposed': '743,000',
                 'type_of_data_compromised': ['Full names',
                                              'Potentially other unspecified '
                                              'data']},
 'date_detected': '2024-08-05',
 'date_publicly_disclosed': '2025-05-05',
 'description': 'McLaren Health Care suffered a data breach caused by an '
                'attack by the INC ransomware gang, affecting 743,000 '
                'patients.',
 'impact': {'data_compromised': ['Full names',
                                 'Potentially other unspecified data'],
            'operational_impact': 'Patient databases impacted',
            'systems_affected': ['IT systems', 'Phone systems']},
 'investigation_status': 'Completed',
 'motivation': 'Financial gain',
 'ransomware': {'ransomware_strain': 'INC'},
 'references': [{'source': 'Unspecified source'}],
 'regulatory_compliance': {'regulatory_notifications': 'Notification submitted '
                                                       'to U.S. authorities'},
 'response': {'communication_strategy': 'Notice sent to impacted individuals'},
 'threat_actor': 'INC ransomware gang',
 'title': 'McLaren Health Care Data Breach',
 'type': 'Ransomware'}