McLaren Health Care hit by another data breach, exposing 743K people’s data
McLaren Health Care, a Michigan healthcare provider, has suffered another data breach, exposing hundreds of thousands of people's personally identifiable information (PII).
Image by Cybernews
McLaren Health Care, a Michigan healthcare provider, has suffered another data breach, exposing hundreds of thousands of people's personally identifiable information (PII).
McLaren Health Care is no stranger to cyberattacks after being struck with a supposed ransomware attack in 2023.
Now, the Michigan healthcare provider has revealed that the data of three-quarters of a million people was impacted in its latest breach.
In a breach notification letter submitted to the Office of the Maine Attorney General, the healthcare service said that in August 2024, “McLaren became aware of suspicious activity” relating to McLaren and Karmanos, a cancer institute that is a part of McLaren Healthcare.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
Through an investigation with third-party specialists, the healthcare provider discovered that someone had hacked into the network between July 17th, 2024, and August 3rd, 2024.
Hackers had managed to access files that included personal information and protected healthcare data, such as:
- Names
- Social Security numbers
- Drivers license numbers
- Medical information
- Health insurance information
Individual healthcare data can be sold on dark web marketplaces and forums for hundreds of dollars.
Hackers and bad actors can then buy this information to commit medical identity theft, a type of fraud where threat actors use stolen information to submit fraudulent claims to Medicare and other health insurers.
At the same time, PII such as names, Social Security numbers, and driver's license information can be used to create a victim profile. This can then be used to commit fraud, identity theft, or be used in sophisticated phishing attacks.
While McLaren Health Care didn’t specify the exact nature of the breach, the healthcare provider has a history of ransomware attacks.
McLaren 2023 ransomware attack exposed information of over 2M people
In July 2023, attackers breached the healthcare provider’s systems and roamed for nearly a month before being detected.
Then, in late September, the prolific ALPHV ransomware gang, also known as BlackCat, posted McLaren Health Care on its dark web blog.
During this attack, a trove of sensitive information was revealed, including names, Social Security numbers, health insurance information, dates of birth, claims information, diagnosis information, medical record numbers, and more.
McLaren Health Care operates 3,100 licensed beds and covers over 732,000 people across its health maintenance organization plans. The company enjoyed a net revenue of $6.6 billion in 2024.