McLaren Health Care mclaren.org McLaren Health Care data breach: what happened and what to do
McLaren Health Care said an intruder was in its network from July 17 to August 3, 2024 and notified 743,131 people in June 2025. Names, Social Security numbers, driver's license numbers, health insurance details and medical information were exposed.
View all 13,115 breaches- Breach date
- 17 Jul 2024
- Made public
- 24 Jun 2025
- Affected
- 743,131
- Data exposed
- Names, Social security numbers, Driver's licenses, Health insurance information, Medical information
- Last updated
What happened
McLaren Health Care, a Michigan hospital system, spotted suspicious activity on August 5, 2024. Its investigation found that an unauthorized party had access to its network from July 17 to August 3, 2024. The forensic review ended in May 2025, and McLaren began mailing notification letters on June 20, 2025.
McLaren told regulators that 743,131 people were affected. The systems involved included those of Karmanos Cancer Institute, part of McLaren's network. It was McLaren's second major incident in under two years: a 2023 attack affected 2.2 million people.
What was exposed
The notice lists names, Social Security numbers, driver's license numbers, health insurance details and medical information.
What it means for you
This combination covers both identity theft and medical fraud. A thief can open credit with your Social Security number, or use your insurance details to bill for care you never received. Medical information also lets scammers write messages that sound like they come from your doctor or insurer.
The company's response
McLaren offered 12 months of free credit monitoring and identity protection to affected people.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If McLaren sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as McLaren or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
- 6
Check your explanations of benefits
Look for claims or providers you don't recognize and report them to your insurer.
Frequently asked
Was I affected?
If you were a McLaren or Karmanos patient, you may have received a letter from June 2025 onward. McLaren reported 743,131 affected people.
What was exposed?
Names, Social Security numbers, driver's license numbers, health insurance details and medical information.
How long were the attackers in the network?
McLaren said the unauthorized access ran from July 17 to August 3, 2024.
Should I change my password?
The notice doesn't list passwords. A credit freeze and checking your insurance statements matter more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
