McLaren Health Care Michigan hit by ransomware, computer and phone systems disrupted
Learn More
On Monday 5th of August 2024, McLaren Health Care, headquartered in Grand Blanc, Michigan, experienced a disruption to its information technology (IT) platforms and telephone systems. The disruption commenced on Monday morning, leading to a cascade of issues across McLaren Health Care’s network.
The incident has affected all 13 of its Michigan hospitals, ambulatory surgery centers, physician offices, and other affiliated facilities and led to widespread service interruptions, impacting patient care, scheduling appointments, accessing test results, addressing medical queries and administrative operations.
Some McLaren websites, including those for its health insurance plans (McLaren Health Plan and McLaren Health Advantage), were down.
Patients with scheduled appointments were advised to keep their appointments unless contacted for rescheduling. Non-emergency or elective procedures might be rescheduled out of an abundance of caution.
Patients are requested to bring essential information to their appointments, including:
- Current medication lists or empty prescription bottles
- Printed physician orders for imaging studies or treatments
- Recent lab test results
- A list of allergies
Ambulances were temporarily diverted from McLaren Port Huron Hospital but resumed normal operations by Tuesday morning.
The reason for this IT disruption has not been disclosed.
This is the second major tech disruption at McLaren Health Care within the last year. In late August 2023, McLaren was targeted by a ransomware attack from the BlackCat/AlphV gang.
Update - as of 8th of August 2024, INC Ransom ransomware gang has taken responsibility for the attack. It's not clear what data was stolen and whether any individuals are impacted.
As of 16th of August 2024, McLaren Health confirmed the ransomware attack, and informes that recovery process will last through August.
As of 22nd of June 2025, nearly a year after the incident, McLaren Health Care reports that the attack affected 743,131 individuals.
The attack was carried out on Karmanos Cancer Institute, an independent organization that's part of McLaren's network. The exposed data include:
- Names
- Social security numbers
- Driver's license numbers
- Medical information
- Health insurance information
McLaren Health Care issued a statement acknowledging the disruption and apologizing for the inconvenience caused to patients and staff. The health system is currently working to determine the extent of the disruption and has not provided a timeframe for restoring full functionality.
