Is the INC ransomware gang behind the attack on McLaren hospitals?

A INC Ransom ransomware attack this week disrupted IT and phone systems at McLaren Health Care hospitals.

On Tuesday, an INC Ransom ransomware attack hit the McLaren Health Care hospitals and disrupted their IT and phone systems. The organizations did not disclose details about the attack, however Bleeping Computer noticed that employees at McLaren Bay Region Hospital in Bay City have shared a ransom note warning that the hospital was hit by INC RANSOM ransomware group.

McLaren Health Care is a nonprofit health care organization based in Grand Blanc, Michigan, USA. It is a $6.6 billion, fully integrated health care delivery system committed to quality, evidence-based patient care and cost efficiency. The McLaren operates 14 hospitals in Michigan, ambulatory surgery centers, imaging centers, a 490-member employed primary and specialty care physician network, commercial and Medicaid HMOs covering more than 732,838 lives in Michigan and Indiana, home health, infusion and hospice providers, pharmacy services, a clinical laboratory network and a wholly owned medical malpractice insurance company. 

Following the cyber attack, McLaren Health Care launched an investigation into the incident. Patients should attend their scheduled appointments unless they receive contact from a member of the care team.

McLaren confirmed that hospitals had lost access to patient information databases, it also requested patients to bring detailed medication information, physician orders, and recent lab test results to their appointments. As a result of the cyber attack, some appointments and elective procedures might be rescheduled as a precaution.

In November 2023, McLaren Health Care (McLaren) disclosed a data breach that occurred between late July and August 2023. The security breach exposed the sensitive personal information of 2,192,515 people.

The company became aware of anomalous activity on or about August 22, 2023, and immediately launched an investigation with the help of third-party forensic experts. The investigation revealed that threat actors gained unauthorized access to McLaren’s network between July 28, 2023, and August 23, 2023.

“On August 31, 2023, McLaren learned the unauthorized actor had the ability to acquire certain information stored on the network during the period of access. As part of an ongoing investigation, McLaren undertook a thorough review of the potentially impacted files to determine whether any sensitive information was present. It was through this process, which concluded on October 10, 2023, that McLaren determined that information pertaining to certain individuals may have been included in the potentially impacted files.” reads the notice of data breach sent to the Maine Attorney General.

Exposed information varied by individual and may include some combination of certain individuals’ names, social Security number, health insurance information, date of birth, and medical information. including billing or claims information, diagnosis, physician information, medical record number, Medicare/Medicaid information, prescription/medication information, diagnostic and treatment information.

McLaren announced to have secured its network and is working to review its existing policies and procedures and to implement additional security measure to protect its infrastructure.

The company also notified U.S. authorities and the impacted individuals. McLaren offers to impacted individuals identity protection services for 12 months.

In early October, 2023, the ALPHV/BlackCat ransomware gang added McLaren Health Care to the list of victims on its Tor leak site. The group claimed to have stolen data belonging to 2.5 million of McLaren Health Care patients.

The INC RANSOM has been active since 2023, it claimed responsibility for the breach of tens of organizations to date. The list of victims includes National Health Service (NHS) of Scotland and the American multinational corporation Xerox Corp.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, 0.0.0.0 Day)