14 Million McLaren Health Care Data Breach Settlement, Are You Eligible to Claim Up to $5,000? Deadline is April 29, 2026

McLaren Health Care Corporation agreed to pay $14,000,000 to resolve a class action lawsuit over two separate ransomware attacks that exposed the private medical and personal information of approximately 2.8 million current and former patients. The breaches occurred in 2023 and again in 2024. The settlement received preliminary court approval on December 15, 2025. Eligible class members can claim up to $5,000 in documented losses — or a pro-rata flat cash payment with no proof required. The claim deadline is April 29, 2026.

Quick Facts

Field	Detail
Settlement Amount	$14,000,000
Claim Deadline	April 29, 2026
Who Qualifies	Anyone whose private info was exposed in the 2023 or 2024 MHCC data breaches
Payout Per Person	Up to $5,000 (with proof); pro-rata flat payment (no proof)
Proof Required	Yes — for documented loss claims; No — for flat cash payment
Settlement Status	Preliminarily approved; Final Approval Hearing April 21, 2026
Case Name	Cindy Womack-Devereaux, et al. v. McLaren Health Care Corporation, No. 24-121459
Court	Michigan 7th Judicial Circuit, Genesee County
Administrator	Angeion Group
Official Website	MHCCSettlement.com

Current Status & What Happens Next

• The $14 million MHCC class action settlement received preliminary approval on December 15, 2025 and covers all individuals in the United States whose confidential information may have been compromised in the 2023 and 2024 data breaches.
• The court will decide whether to grant final approval at a hearing on April 21, 2026. Compensation begins distributing to class members only after final approval and any appeals are resolved.
• All claim forms must be submitted online or by mail by April 29, 2026.

What Is the McLaren Health Care Lawsuit About?

McLaren Health Care experienced two separate ransomware attacks within the space of a single year. The first was carried out by the ALPHV/BlackCat ransomware group, which accessed the network from July 28, 2023, to August 23, 2023. The second attack was carried out by the Inc Ransom ransomware group, which accessed the network between July 17, 2024, and August 3, 2024.

The ALPHV/BlackCat attack affected 2,103,881 individuals. The Inc Ransom attack affected 743,131 individuals. Together, those two incidents affected roughly 2.8 million people nationwide.

The class action lawsuit alleged that McLaren had inadequate security measures, did not comply with industry standards for data security, FTC guidelines, or HIPAA rules, resulting in the first attack. Then, McLaren failed to learn from that ransomware attack and did not make the necessary security upgrades to prevent a second incident.

McLaren denies the allegations but agreed to settle to avoid the risk and expense of continued litigation. The settlement also requires McLaren to enhance its data security measures going forward.

Related article: Greenbrier Lawsuit 2026, Justice Family Says TRT Holdings And Carter Bank Is Trying to Steal Their Resort

Who Is Eligible to File a Claim?

• You may qualify if your personal or protected health information was exposed in either the July 28–August 23, 2023 breach or the July 17–August 3, 2024 breach.
• You may qualify if you received a data breach notification letter from McLaren Health Care Corporation or an affiliated entity such as Karmanos Cancer Institute.
• You may qualify if you were a current or former patient of McLaren Health Care — eligibility is not limited to Michigan residents; millions of people nationwide are included in the settlement class.
• You may qualify even if you did not receive a notice letter — consumers who believe they may be a class member but did not receive a notice can contact the settlement administrator to confirm their identity and obtain their login details.
• You may qualify if the exposed data included your name, Social Security number, date of birth, health insurance information, or detailed medical records.

How Much Can You Receive?

The settlement offers three separate benefit options, and you can select the ones that apply to your situation.

Option 1 — Documented Loss Payment (up to $5,000) Class members who submit documented proof of out-of-pocket losses incurred due to the data breaches are eligible to receive a one-time cash payment of up to $5,000. Losses must have been incurred on or after July 28, 2023, and class members may not receive payment for losses already reimbursed from another source.

Option 2 — Flat Cash Payment (no proof required) A pro-rated cash payment is also available for class members who do not submit documentation. Final payment amounts will depend on how many valid claims are submitted and how the settlement fund is allocated. Keep in mind that pro-rata payments in large data breach settlements can be modest — sometimes ranging from a few dollars to a few hundred dollars — depending on total claims filed.

Option 3 — Free Credit Monitoring All class members are eligible to elect the credit monitoring settlement benefit. Submitting the claim form does not automatically enroll you — you must check the credit monitoring box on the claim form and follow the enrollment instructions sent to your email address after the settlement becomes final.

You can select more than one option on your claim form.

How to File a Claim

1. Visit the official settlement website at MHCCSettlement.com or call 1-844-685-4251 for assistance.
2. Enter your Unique Notice ID and confirmation code from your mailed or emailed settlement notice. If you did not receive a notice, you must mail a paper claim form with supporting documentation.
3. Select your benefit type — documented losses (up to $5,000), flat pro-rata cash payment, credit monitoring, or any combination.
4. Upload or attach proof of losses if you are filing for the documented loss payment. Acceptable documentation includes bank or credit card statements showing unreimbursed fees or charges due to fraud, receipts, invoices, or other proof of monetary losses from identity theft.
5. Submit your claim online by April 29, 2026, or mail your completed claim form postmarked by that same date to: MHCC Class Action Settlement, 1650 Arch St., Suite 2210, Philadelphia, PA 19103.
6. Save your confirmation number for your records.

Estimated time to complete: 10–15 minutes.

Important Deadlines & Dates

Milestone	Date
First Breach Period	July 28 – August 23, 2023
Second Breach Period	July 17 – August 3, 2024
Settlement Agreement Signed	January 12, 2026
Preliminary Approval Granted	December 15, 2025
Objection / Opt-Out Deadline	March 16, 2026
Claim Filing Deadline	April 29, 2026
Final Approval Hearing	April 21, 2026
Expected Payment Date	TBD — after final approval and any appeals

Frequently Asked Questions

Do I need a lawyer to file a claim?

 No. The claim process is straightforward and designed for everyday consumers to complete on their own. Visit MHCCSettlement.com, enter your notice ID, choose your benefit type, and submit. You do not need legal representation to participate in this settlement.

Is this settlement legitimate?

 Yes. The court-approved website for the MHCC class action settlement is MHCCSettlement.com. The settlement received preliminary approval on December 15, 2025, from the Michigan 7th Judicial Circuit, Genesee County. The settlement administrator is the Angeion Group, a reputable third-party claims administration firm.

When will I receive my payment?

Compensation will begin distributing to class members only after final approval has been granted and any appeals have been resolved. The final approval hearing is April 21, 2026. Payments are expected sometime after that date, assuming the court approves the settlement and no appeals are filed.

What if I missed the claim deadline? 

If you miss the April 29, 2026 deadline, you will not receive any payment from the settlement fund. You will still be bound by the settlement and cannot bring your own separate lawsuit over the same data breach claims. If the deadline has passed, visit the settlement website to confirm whether any extension has been granted.

Will this settlement payment affect my taxes?

 Possibly. Settlement payments related to data breach claims can be taxable income depending on how the IRS classifies them. The settlement agreement addresses tax responsibilities through the escrow structure. Consult a tax professional if you are uncertain how to treat any payment you receive, particularly larger documented-loss payments.

What data was actually exposed in these breaches?

 Sensitive personal information belonging to current and former MHCC patients that may have been affected includes names, Social Security numbers, health insurance information, dates of birth, and detailed medical information. Medical data is particularly serious because, unlike a password, you cannot change your health history or Social Security number once it is compromised.

What if I was affected by both breaches?

 You file one single claim form covering both breach periods. The settlement covers all individuals impacted by either or both of the 2023 and 2024 data incidents. You do not need to file separately for each breach.

What is HIPAA and why does it matter here?

 HIPAA — the Health Insurance Portability and Accountability Act — is the federal law that requires healthcare providers to protect patient health information. The class action alleged McLaren violated HIPAA standards, FTC guidelines, and Michigan consumer protection law by failing to implement adequate cybersecurity protections before either breach occurred.

For more on how healthcare providers are held accountable when patient data is exposed, read about the Google Android $135M data privacy settlement claims and the Naviance student data privacy $17.25M settlement on AllAboutLawyer.com.

Sources & References

• Official Settlement Website: MHCCSettlement.com
• Official Claim Form (PDF): Angeion Group / MHCCSettlement.com
• Official Settlement Notice (PDF): Angeion Group / MHCCSettlement.com

Last Updated: April 14, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.