Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
“2.2 million” refers to the scale of notices tied to McLaren Health Care’s 2023 data breach—not a finding that every person had the same information exposed. In August 2024, Michigan’s Attorney General said McLaren had sent breach notices to approximately 2,148,749 Michigan residents. A separate Maine Attorney General filing search result lists 2,192,515 people, with notification dated November 9, 2023. Those figures reflect different sources and may not measure the same population.
What happened in McLaren Health Care’s 2023 breach?
On October 6, 2023, Michigan Attorney General Dana Nessel said the ALPHV/BlackCat ransomware group claimed it had stolen sensitive personal health information from McLaren patients. At the time, the actual number of affected patients, their identities, and the types of information involved were unknown, according to the Attorney General’s release. McLaren was investigating, had retained security experts, and was in contact with law enforcement. It said it would notify people if their information was impacted.
The state said care continued at all McLaren locations and patient care was unaffected at that time. The attacker’s claim reportedly involved 2.5 million patients; that was the group’s claim, not a verified victim count established in the 2023 release.
What does the 2.2 million figure mean?
The commonly rounded figure points to the large number of notices associated with the 2023 incident, but exact totals differ by source. Michigan’s Attorney General reported in August 2024 that approximately 2,148,749 Michigan residents had been sent notice letters about the 2023 breach. A Maine Attorney General filing search result separately lists 2,192,515 people affected and gives a consumer notification date of November 9, 2023. These counts should be attributed to their respective sources rather than treated as interchangeable totals.
#1 Best Overall
Neither figure means that every person had identical records exposed. The Michigan Attorney General’s initial October 2023 release said the information involved was not yet known. If you received a letter, use that notice—not the rounded headline figure—to learn what McLaren says applied to you.
How was the separate 2024 McLaren attack different?
McLaren reported a new disruption on August 6, 2024, which it attributed to a criminal cyberattack. In its August 9 release, Michigan’s Attorney General said facilities were largely operational but McLaren had limited access to systems; McLaren had not provided a date for full system functionality. This was a separate incident from the 2023 breach, not a later phase of the same event.
| Incident | Population reported | Information and operational impact reported |
|---|---|---|
| 2023 ransomware incident | Approximately 2,148,749 Michigan residents sent notices, according to Michigan’s Attorney General in 2024; a Maine Attorney General filing search result lists 2,192,515 people, with notification dated November 9, 2023. | The October 2023 release said the types of information were then unknown. The attacker claimed to have stolen sensitive personal health information. The state said care continued and patient care was unaffected at that time. |
| August 2024 ransomware incident | More than 740,000 people notified, according to Bridge Michigan’s June 26, 2025 report. | Bridge Michigan reported potentially exposed medical history, treatment details, Social Security numbers, health insurance, and medication records. The 2024 incident also involved limited systems access, while facilities were largely operational as of the Attorney General’s August 9, 2024 release. |
Bridge Michigan reported that McLaren offered complimentary identity protection to people affected by the 2024 incident. The report quoted McLaren spokesperson Dave Jones as saying there was no evidence at that time of actual or attempted misuse of personal information resulting from that attack. That statement concerns the 2024 incident and should not be read as a finding about the 2023 breach.
Was my information exposed in the McLaren data breach?
A notice from McLaren is the clearest indication that the organization identified you as someone whose information may have been affected. The figures reported by state authorities are population-level totals, not a way to determine whether a particular person’s records were involved or what those records contained. If you are unsure, contact McLaren using contact information from its official website or your notice, and do not rely on an unsolicited caller or email to confirm your identity.
What should I do after getting a McLaren data breach letter?
Michigan’s Attorney General recommends practical steps for people who receive a breach notice or are concerned about a medical provider breach:
- Change the password for your medical portal. If you reused it elsewhere, change it on those accounts too.
- Review your insurer’s Explanation of Benefits (EOB) statements and question services or medications you do not recognize.
- Contact your bank and credit card issuers about placing alerts on your accounts.
Watch for signs that someone may be using your medical or insurance information:
- Bills for services you did not receive.
- EOB statements listing unfamiliar services or medications.
- Debt collectors seeking medical bills you do not owe.
- Medical debt on a credit report that you do not recognize.
- An insurer’s notice that you have unexpectedly reached a benefit limit.
- A coverage denial based on a pre-existing condition you do not have.
The Attorney General also says you may consider a credit freeze. The state says freezes are free and must be placed separately with Equifax, Experian, and TransUnion. A freeze can make it harder for someone to open new credit in your name, but it cannot prevent every form of medical identity misuse.
If your notice concerns the 2024 incident
Check the notice itself for the identity-protection provider, enrollment instructions, and any deadline. Bridge Michigan’s report confirms McLaren offered complimentary identity protection, but does not establish the provider or current enrollment terms. Follow the terms in your own notice rather than assuming an offer or deadline applies to everyone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is there a settlement for the McLaren data breach?
The official MHCC Class Action Settlement website describes a proposed $14 million settlement related to two McLaren Health Care data breaches in 2023 or 2024. The current approval status, who is eligible, how to make a claim, and any deadlines are not established here. Do not assume you qualify or that the settlement is final; check the official settlement site and court-approved documents for current terms.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
