McLaren Health Care Facing 3 Lawsuits in Ransomware Hack

A recent attack by a Russian ransomware-as-a-service group that stole the personal information of 2.5 million patients of McLaren Health Care has triggered at least three proposed federal class action lawsuits in recent days, claiming the healthcare company failed to protect patient privacy.

See Also: Challenges and Solutions in MSSP-Driven Governance, Risk, and Compliance for Growing Organizations

The lawsuits – which each make similar allegations, including negligence by McLaren – were all filed in the same Michigan federal court by plaintiffs who are – or were – McLaren patients on behalf of themselves and others situated.

The litigation was filed only days after Alphv/Blackcat on Sept. 29 boasted on its dark web site to have stolen 6 terabytes of “sensitive data” pertaining to 2.5 million McLaren patients. The threat actor also claimed its “backdoor is still running” on McLaren’s network (see: Group Claims it Stole 2.5 Million Patients’ Data in Attack).

Attorneys filed lawsuits quickly against McLaren – even before the company notified individuals whose information was potentially affected by the late August ransomware attack.

McLaren in a statement to Information Security Media Group last week said it had contacted law enforcement about the incident, but as of Tuesday it remained unclear whether McLaren had yet officially filed any data breach reports with regulators.

No report involving McLaren has been posted on the Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

On Friday, Michigan state attorney general Dana Nessel issued a “consumer protection reminder” warning that a recent ransomware attack by Alphv/Blackcat on Grand Blanc, Michigan-based McLaren Health Care “could affect large numbers of patients.”

While the ransomware group claims to have stolen data pertaining to 2.5 million individuals, “the actual number and identity of affected patients is unknown, as is the type of protected health information,” Nessel said.

“This attack shows, once again, how susceptible our information infrastructure may be,” Nessel said in the statement. “Organizations that handle our most personal data have a responsibility to implement safety measures that can withstand cyberattacks and ensure that a patient’s private health information remains private.”

Michigan does not require private entities to provide notices reporting data breaches to the attorney general’s office. “We became aware of the breach through McLaren’s public remarks and issued an alert to provide awareness and personal privacy/security tips and resources to Michigan consumers,” the AG’s office said Tuesday. Also, the Michigan AG’s office has not been in contact with McLaren, the AG’s office said.

McLaren declined ISMG’s request for comment on whether or when it planned to file a data breach report, the status of its investigation into the incident, and reaction to the three proposed class action lawsuits.

McLaren is a $6.6 billion integrated healthcare delivery system that includes 15 hospitals and dozens of other medical facilities. The organization also operates Michigan’s largest network of cancer centers and care providers.

Lawsuit Allegations

Plaintiff Cheryl Drugich in her lawsuit filed on Oct. 5 alleges that McLaren maintained private information “in a reckless manner” that was left vulnerable to unauthorized intrusions and cyberattacks.

The data exfiltrated in the McLaren incident “remains in the hands of cybercriminals who target private information for its value to identity thieves,” Drugich’s lawsuit complaint alleges.

Drugich’s allegations were similar to claims in the other two proposed class action lawsuits filed by plaintiffs Jamie McSkulin on Friday and by Kati Komorosky yesterday.

The lawsuits seek similar relief, including punitive damages and injunctive orders for McLaren to improve its security practices.

Attorneys representing plaintiffs in the litigation against McLaren did not immediately respond to ISMG’s requests for comment.

McLaren in its statement to ISMG last week said it detected suspicious activity in its IT systems in August and confirmed the incident involved a ransomware attack. The entity took its computer network offline during incident response but said patient care was unaffected.