McLaren Health Care $14M Data Breach Settlement – 2.8M Patients Can Claim Up To $5,000, Deadline April 29, 2026
McLaren Health Care Corporation agreed to pay $14 million to settle class action claims over two ransomware attacks in 2023 and 2024 that exposed personal and medical information of approximately 2.8 million patients and employees. If you received a data breach notice from McLaren or Karmanos Cancer Institute, you can file a claim by April 29, 2026 for up to $5,000 in documented losses, a pro-rata cash payment, or one year of free credit monitoring.
What Are the McLaren Data Breaches About?
Between July 28 and August 23, 2023, the ALPHV/BlackCat ransomware group gained unauthorized access to McLaren’s computer network. Just one year later, between July 17 and August 3, 2024, the Inc Ransom group struck again, accessing McLaren’s systems in a separate attack.
The breaches exposed sensitive information including names, Social Security numbers, dates of birth, health insurance information, billing details, and comprehensive medical records. McLaren Health Care, a $7.3 billion integrated healthcare system headquartered in Grand Blanc, Michigan, operates 12 hospitals and dozens of medical facilities across Michigan, Indiana, and Ohio.
Plaintiffs Cindy Womack-Devereaux, Sue Ranney, and Kayle Gries filed consolidated class action lawsuits in Michigan state court alleging McLaren failed to implement adequate cybersecurity measures despite storing highly sensitive patient data. Similar to recent continuum healthcare data breach settlements, this case demonstrates that healthcare providers face serious financial consequences when patient information isn’t properly protected.
Who Is Affected by These Data Breaches?
The settlement class includes all United States residents whose personal information may have been compromised during either the 2023 or 2024 data breaches. Approximately 2.8 million individuals received data breach notifications from McLaren Health Care Corporation or Karmanos Cancer Institute.
If McLaren sent you a letter or email about either breach—the July-August 2023 incident or the July-August 2024 incident—you’re automatically part of the settlement class. You don’t need to have been a direct McLaren patient; the breaches also affected employees and individuals whose data was stored in McLaren’s systems for any reason.
The case is being handled by the 7th Judicial Circuit Court in Genesee County, Michigan (Case No. 24-121459-GC) before the Honorable B. Chris Christenson. The court granted preliminary approval on December 15, 2025, allowing the settlement process to move forward.
How Much Money Can You Receive?
McLaren’s $14 million settlement fund offers multiple compensation options depending on your situation and documentation.
Option 1: Documented Loss Payment
Claim up to $5,000 for out-of-pocket expenses traceable to the data breaches. Eligible losses include unreimbursed fraudulent charges or bank fees, credit monitoring services you purchased, identity theft insurance costs, professional fees for resolving identity theft (legal or accounting), credit report fees or credit freeze expenses, and documented time spent addressing breach-related issues.
All losses must have occurred on or after July 28, 2023 (the start of the first breach) and must be more likely than not a result of one of the data breaches. You cannot receive reimbursement for losses already covered by another source.
Option 2: Pro-Rata Cash Payment
If you don’t have documented losses, you can still claim a flat cash payment without providing receipts. This amount will be calculated pro-rata based on the number of claims filed and what remains in the settlement fund after deducting attorneys’ fees (up to $4.6 million or one-third of the fund), administration costs, and documented loss payments.
Option 3: Credit Monitoring Services
All settlement class members can elect one year of credit monitoring through IDX Identity Protection Services, which includes dark web scanning, $1 million in reimbursement insurance, fully managed identity restoration, member advisory services, and lost wallet assistance. You can choose this in addition to either cash payment option.
How to File Your McLaren Settlement Claim
Visit the official settlement website at MHCCSettlement.com to submit your claim online. You’ll need your unique Notice ID and Confirmation Code from the data breach notification McLaren sent you.
If you received a notice but can’t locate it, call the settlement administrator at 1-844-685-4251 for assistance. If you believe you’re in the settlement class but didn’t receive a notice, you can still file a claim by mailing a paper form with supporting documentation showing you were affected by one of the breaches.
For documented loss claims, gather all supporting documentation including bank or credit card statements showing unreimbursed fraudulent charges, receipts for credit monitoring services or identity theft protection you purchased, invoices for professional fees, credit reports showing fraud, and any other proof of monetary losses directly traceable to the breaches.
Submit your claim online at MHCCSettlement.com or mail completed forms to: MHCC Class Action Settlement, Attn: Claim Forms, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.
The claim deadline is April 29, 2026. Claims submitted or postmarked after this date will not be processed.
Settlement Timeline and Critical Dates
March 16, 2026: Deadline to opt out of the settlement or file objections with the court. If you disagree with the settlement terms, you must submit written objections explaining your concerns by this date.
April 21, 2026: Final approval hearing at 10:00 a.m. before Judge B. Chris Christenson in the 7th Judicial Circuit Court, Genesee County, Michigan. The judge will decide whether to grant final approval and award attorneys’ fees.
April 29, 2026: Claim filing deadline. All claim forms must be submitted online or postmarked by mail by this date.
If the court grants final approval and no appeals are filed, payments and credit monitoring codes will be issued to approved claimants approximately 60-90 days later—likely by July or August 2026.
Common Mistakes to Avoid
Many patients throw away breach notification letters without reading them carefully. Your Notice ID and Confirmation Code from that letter are required to file your claim online. Save these documents.
Don’t wait until late April to file your claim. Gathering documentation for documented loss claims takes time, especially if you need to request old bank statements or receipts. Start collecting proof now if you plan to claim reimbursement.
Some patients assume they can’t claim anything because they haven’t experienced identity theft yet. Wrong. You can file for the pro-rata cash payment even if you have no documented losses. You’re entitled to compensation for the privacy violation and increased risk of future identity theft.
Missing the April 29, 2026 deadline means you forfeit all settlement benefits. Set a calendar reminder for at least two weeks before the deadline to ensure you don’t miss out.
2026 Settlement Updates
As of February 2026, McLaren has begun mailing settlement notices to all affected individuals. If you received services at any McLaren facility or Karmanos Cancer Institute during the breach periods, watch your mail carefully for official settlement communications.
Michigan state officials previously issued public warnings urging consumers to monitor their credit and accounts proactively following the McLaren attacks. The ransomware groups responsible for both breaches are known threat actors with established patterns of targeting healthcare systems.
As part of the settlement agreement signed on January 12, 2026, McLaren agreed to enhance its data security systems for at least two years to better protect sensitive patient information. McLaren denies all wrongdoing and maintains it had meritorious defenses, but agreed to settle to avoid the expense and uncertainty of continued litigation.
Are You Eligible to File a Claim?
You qualify if your personal information may have been compromised during either breach period:
- First Breach: July 28, 2023 through August 23, 2023 (ALPHV/BlackCat attack)
- Second Breach: July 17, 2024 through August 3, 2024 (Inc Ransom attack)
Check your mail and email from late 2023 through mid-2025 for data breach notifications from McLaren Health Care Corporation or Karmanos Cancer Institute. The notifications would have explained that your personal or health information may have been accessed by unauthorized parties.
Former McLaren patients who received care during the breach periods also qualify, even if they’re no longer using McLaren facilities. If McLaren had your information in their systems during either attack window, you’re part of the settlement class.
If you’re uncertain about your eligibility, contact the settlement administrator at 1-844-685-4251 or email [email protected]. They can verify whether you’re in the settlement class using your basic information.
When Legal Advice May Help
Most settlement class members can file claims without legal representation. The process is straightforward and designed for patients to handle themselves.
However, if you suffered substantial identity theft damages exceeding $5,000—such as major fraudulent charges, severe credit damage, or extensive professional fees for resolving identity theft—consult a consumer protection or data breach attorney before filing.
You have the right to opt out of the settlement by March 16, 2026 and pursue an individual lawsuit. This makes sense only if your documented losses significantly exceed the $5,000 settlement cap and you’re willing to hire legal representation.
Similar to other signature-performance healthcare data breach lawsuits, most affected individuals find participating in the class action settlement is the simplest and most cost-effective option. Consumer attorneys typically only recommend opting out when individual damages are substantial and well-documented.
Where to Find Official Information
The official settlement website is MHCCSettlement.com. Visit this site for complete settlement details, claim forms, legal documents, FAQs, and updates on the approval process.
For questions, contact the settlement administrator:
- Website: MHCCSettlement.com
- Phone: 1-844-685-4251
- Email: [email protected]
- Mail: MHCC Class Action Settlement, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103
For questions about your McLaren account or medical records, contact McLaren Health Care directly. For settlement-specific questions about eligibility, claim forms, or payment amounts, contact the settlement administrator.
Court documents are publicly available through the Genesee County Circuit Court for Case No. 24-121459-GC. Michigan court records can typically be accessed through the Michigan state court system.
Stay alert for scam emails or calls. Legitimate settlement communications will never ask for credit card information, banking details, or upfront payments. Always verify by visiting MHCCSettlement.com directly or calling the verified number 1-844-685-4251.
FAQs
What is the McLaren Health Care data breach settlement about?
McLaren Health Care agreed to pay $14 million to settle claims it failed to protect patient information during two ransomware attacks—ALPHV/BlackCat in July-August 2023 and Inc Ransom in July-August 2024—that exposed personal and medical data of approximately 2.8 million individuals.
How much is the McLaren settlement worth?
The total settlement fund is $14 million. Individual payments range from a pro-rata cash payment (amount varies based on claims filed) to up to $5,000 for documented losses, plus one year of free credit monitoring for all class members.
Which McLaren patients are affected?
All U.S. residents whose personal information may have been compromised during the July 28-August 23, 2023 breach or the July 17-August 3, 2024 breach, including those who received data breach notifications from McLaren or Karmanos Cancer Institute.
Am I eligible to file a claim?
Yes, if McLaren sent you a data breach notification about either the 2023 or 2024 incident. You don’t need to prove identity theft or financial harm—just that your data was exposed in one of the breaches.
What is the claim deadline?
Claims must be submitted online or postmarked by April 29, 2026. The final approval hearing is April 21, 2026, and the opt-out/objection deadline is March 16, 2026.
How much compensation can I receive?
Up to $5,000 for documented losses with supporting receipts, or a pro-rata cash payment without documentation. The exact pro-rata amount depends on total claims filed and remaining settlement funds after costs.
What documentation do I need?
For documented loss claims over $5,000, you need bank statements, credit card statements, receipts, invoices, or other third-party proof showing unreimbursed losses that occurred on or after July 28, 2023. For pro-rata cash payments, no documentation is required.
How do I submit my claim?
Visit MHCCSettlement.com and enter your Notice ID and Confirmation Code, or download and mail a paper claim form. Call 1-844-685-4251 for assistance if you didn’t receive a notice but believe you’re eligible.
When will I receive my settlement payment?
If the court grants final approval on April 21, 2026, and no appeals are filed, payments and credit monitoring codes will be distributed approximately 60-90 days later—likely by July or August 2026.
Last Updated: February 11, 2026
Disclaimer: This article provides general information about the McLaren Health Care data breach settlement and is not legal advice. For questions specific to your situation, visit MHCCSettlement.com or contact the settlement administrator.
What to Do Next: Visit MHCCSettlement.com now to file your claim. Don’t wait until April—gather your documentation and submit before the April 29, 2026 deadline.
Stay informed, stay protected. — AllAboutLawyer.com
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah