November 17, 2023. The privacy and data breach team at Tycko & Zavareei LLP filed a class action lawsuit in federal court against Michigan-based health system McLaren Health Care Corp. The lawsuit alleges that the data breach “was a direct result of McLaren’s deficient cybersecurity practices” and their failure to timely notify affected individuals exacerbated the harm caused by the breach. The attack allegedly compromised personal identifiable information (PII) and protected health information (PHI), including Medicare and Medicaid details, Social Security numbers, date of birth, and more health-related information of over 2 million individuals.
The lead plaintiff, Melissa Porter, claims McLaren’s data security measures were inadequate, enabling hackers, identified as the Alphv/BlackCat group, to access highly sensitive information. The lawsuit contends that McLaren had prior warnings of such threats, citing Department of Health and Human Services and FBI alerts. The delayed announcement of the breach details in November exacerbated patient harm, including the risk of medical identity theft.
The suit brings statutory, negligence, and unjust enrichment claims against McLaren, urging the implementation of industry-standard security practices. Multiple lawsuits in Michigan have been filed against McLaren regarding the data breach.
The case is Porter v. McLaren Health Care Corporation, Case No.: 2:23-cv-12939, in the U.S. District Court for the Eastern District of Michigan