INC Ransom suspect for the McLaren hospitals disruptions

The recent disruption at the McLaren Health Care hospitals was allegedly linked to the attack executed by the INC Ransom ransomware group.

McLaren is a non-profit healthcare system with more than $6.5 billion in annual revenues. It maintains a network of 13 hospitals in the state of Michigan and is home to more than 640 physicians.

Moreover, it employs over 28,000 individuals and works with 113,000 network providers in two other states, Indiana and Ohio, in addition to Michigan.

The company stated that while its team investigates a disturbance in its IT system, it wanted to ensure that its healthcare providers are ready to care for patients when they come. In addition, patients who have scheduled appointments should plan to attend them unless a hospital care team member contacts them.

 

McLaren Hospitals had lost its patient database after the alleged INC Ransom group campaign.

 

McLaren explained that the suspected INC Ransom ransomware group impacted hospitals after most of them lost access to patient information databases. This effect prompted the healthcare entity to advise patients to bring comprehensive information about their current drugs to appointments.

These details include information such as physician orders and documented lab test results. The health organisation also stated that it may need to reschedule some appointments and non-emergency or elective treatments for the safety of the patients.

The organisation also asks for the patience of every concerned individual while its caregivers and support teams work to offer the care their communities require and deserve.

Although McLaren has yet to reveal the nature of the incident, employees at one of its regional hospitals shared a ransom note warning that the hospital’s systems have been encrypted and that stolen data will be published on the INC RANSOM ransomware gang’s leak site if the ransom is not paid.

The INC ransomware group is a ransomware-as-a-service (RaaS) attack that began in July 2023 and has since attacked businesses in both the government and private sectors. Some of its most targeted entities include educational, hospital, government, and industrial institutions.