Analyst assessment
McLaren Health Care’s 2024 ransomware attack disrupted information technology and phone services across its Michigan health system. Its official Aug. 7 acknowledgment confirmed a criminal cyberattack and described hospital and outpatient downtime procedures.
McLaren’s 2024 annual report dates the systemwide cyberattack to Aug. 5 and says the organization locked down its systems and shifted to paper records. A subsequent notification letter identifies unauthorized access July 17-Aug. 3, an earlier intrusion window that does not establish the start of patient-service disruption. This incident is separate from McLaren’s 2023 attack.
Operational significance
McLaren reported limited system access, rescheduled non-emergency care and asked patients to bring medication information, printed orders and test results. Emergency departments and most surgeries continued. Later reporting of the health system’s updates described ambulance diversion for certain conditions at some locations, alongside continued clinical operations.
By Aug. 26, McLaren reported its IT platforms and clinical and administrative operations restored, according to its statement to Becker’s Hospital Review. Staff had begun transferring manually charted patient information into electronic records. That remaining work separates restored access from completed records reconciliation.
Confidence and uncertainty
Ransomware confidence is high: McLaren identified ransomware in its later statements and filed notification. Responsibility remains less certain. An Aug. 5 public post shared an alleged INC Ransom note from the Bay City location, asserting encryption and threatening disclosure of stolen information unless paid. The photograph establishes a public allegation, rather than independently authenticated attribution or a verified inventory of encrypted and copied files.
The June 2025 notification describes potentially affected personal information and a file review completed May 5, 2025. Those later investigation and notification dates do not establish continuing hospital outages. The reviewed letter uses variable data fields, limiting conclusions about the information involved for every recipient.
Indiana’s 2025 breach register lists 743,131 people affected by the incident, including 530 Indiana residents, and records June 20, 2025, as the notification date. This reported count does not establish which information was involved for every person.
A Michigan judge granted final settlement approval April 21, 2026. The agreement’s $14 million fund covers claims arising from both the 2023 and 2024 breaches, without an admission of wrongdoing. The combined fund does not establish the cost of the 2024 attack alone or a ransom payment.
Analytic gaps
The final date for completing manual-records entry remains unverified. The incident is presumed resolved at the research cutoff, with no confirmed end date for all recovery work. The Aug. 26 restoration milestone should not be extended by the projected duration of the backlog.
The initial entry route, complete data-impact inventory, authentication of the alleged INC note and ransom-payment outcome remain unverified.
