McLaren Health Care Lawsuit: $14M Breach Settlement and a Pending Tracking Case
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Two different things sit behind a search for a McLaren Health Care lawsuit. The one in the news is the $14 million McLaren Health Care settlement over the 2023 and 2024 ransomware attacks — approved, with the claim deadline of April 29, 2026 already passed. The other is a federal privacy suit alleging McLaren shared patient data with third parties through tracking tools. That one has no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuits Say Happened
The data breaches. According to the settlement notice, unauthorized third parties may have reached patients' and employees' personal and health information twice: between July 28 and August 23, 2023, and again between July 17 and August 3, 2024. Per HIPAA Journal, the 2023 attack affected 2,103,881 people and the 2024 attack 743,131. Exposed data included names, Social Security numbers and information about health conditions, treatment and payment.
The lawsuits allege McLaren used inadequate security and then failed to make the upgrades that would have prevented the second attack. They pleaded negligence, breach of implied and express contract, and unjust enrichment. McLaren denies the allegations and did not admit fault by settling.
The tracking case. A separate McLaren Health Care class action lawsuit, filed in 2025, alleges that McLaren disclosed patients' personally identifiable and protected health information to third parties without consent. That claim is unproven.
Case Details
The breach cases ran on two tracks. After the 2023 attack, at least eight suits were consolidated as Drugich v. McLaren Health Care Corporation, No. 23-cv-12520, in the U.S. District Court for the Eastern District of Michigan, before Judge Matthew F. Leitman. After the 2024 attack, suits were consolidated as Womack-Devereaux v. McLaren Health Care Corporation, No. 24-121459, in the 7th Judicial Circuit Court for Genesee County, Michigan, before Judge B. Chris Christenson. The settlement was approved in the Genesee County case and covers both breaches.
The tracking case is Wehrle v. McLaren Health Care Corporation, No. 25-cv-11420, also in the Eastern District of Michigan before Judge Leitman. It was filed on May 14, 2025.
Status: Settlement Approved, Tracking Case Pending
Tracking case: last confirmed pending in 2025, no settlement. McLaren moved to dismiss. On August 11, 2025 the judge let the plaintiff amend her complaint, and on August 25, 2025 he ended that first motion without prejudice. Law360 reported on October 23, 2025 that Michigan healthcare facilities, McLaren among those tagged, asked a federal judge to dismiss a proposed class action over data-tracking pixel tools; the free preview does not name the case, so we cannot confirm it is this one. We found no published ruling, no settlement, no fund and no claim form.
Who Is Covered
Breach settlement: the class covers everyone in the United States whose information was compromised in either breach, including anyone sent a breach notice. If you filed a claim by April 29, 2026, you are in line for a payment once the administrator distributes funds. If you did nothing and did not opt out, you are bound by the settlement but receive no cash.
Tracking case: it is a proposed class, and no class has been certified. If you used McLaren's website or its patient portal, My McLaren Chart, you are the kind of person it describes. Our form on this page asks whether you used the website or the portal, what you did there and when you last did it. That is the information that matters if a tracking settlement ever happens. You can also start with our MyChart claim checklist.
What the Settlement Pays
Documented losses up to $5,000 per person. These must be incurred on or after July 28, 2023 and backed by receipts or statements.
A pro rata cash payment with no documentation. It is paid from what remains after fees, administration costs, service awards, monitoring and loss claims. No per-person figure has been published.
One year of one-bureau credit monitoring. The activation code is sent with the payment distribution.
The $14 million fund covers more than 2.8 million people. That is why the flat payment depends almost entirely on how many people filed. For the tracking case there is no settlement, no fund and no claim form. Our data breach settlement calculator and MyChart settlement calculator show typical ranges in comparable cases. They do not predict this one.
McLaren Health Care Lawsuit Timeline
- 1
July 28 – August 23, 2023 — First Ransomware Attack
Unauthorized access to McLaren's network. It is detected on August 22, 2023, and notice letters go out on November 9, 2023.
- 2
October 5, 2023 — First Federal Suits
Drugich v. McLaren is filed in the Eastern District of Michigan. At least eight breach suits are later consolidated there as No. 23-cv-12520.
- 3
July 17 – August 3, 2024 — Second Attack
A second intrusion affects 743,131 people. On August 26, 2024 the Womack-Devereaux case is filed in Genesee County.
- 4
May 14, 2025 — Tracking Suit Filed
Wehrle v. McLaren, No. 25-cv-11420, alleges patient data was shared with third parties without consent. It has no settlement.
- 5
December 15, 2025 — Preliminary Approval Hearing on $14 Million Deal
The Genesee County court considers the combined settlement for both breaches. The opt-out deadline is set for March 16, 2026 and the claim deadline for April 29, 2026.
- 6
April 21, 2026 — Final Approval
The court grants final approval after this hearing. The claim window closed on April 29, 2026, and payments to valid claimants are pending.
Three Things to Watch For
A big settlement with a closed claim window, plus a second open case, is exactly the confusion imposters use:
“Late claim” or “reopened deadline” offers
The McLaren Health Care settlement deadline was April 29, 2026, and no court has extended it. Anyone offering to file a late claim for a fee, or asking for your Social Security number to “reinstate” you, is not the administrator.
Payment messages from the wrong address
The court-appointed administrator is Angeion Group, and the only official site is MHCCSettlement.com (toll-free 1-844-685-4251). A text or email linking anywhere else to “confirm your bank details” for your payout should be checked against that site before you reply.
“Claim your MyChart tracking money”
The tracking case against McLaren has no settlement, no fund and no claim form. A page promising a payout for My McLaren Chart use today is selling something that does not exist.
McLaren Health Care Class Action — Questions People Ask
Is there a McLaren Health Care class action settlement?
Yes, for the data breaches. A $14 million settlement covering the 2023 and 2024 ransomware attacks received final approval in Genesee County, Michigan after an April 21, 2026 hearing. The claim deadline was April 29, 2026.
Can I still file a claim?
No. The claim deadline was April 29, 2026 and the opt-out deadline was March 16, 2026. If you missed both, you are bound by the settlement and will not receive a cash payment.
When will McLaren settlement payments arrive?
As of October 2026 we found no announcement of a payment date. Class counsel said valid claimants could expect payment in 2026. Check MHCCSettlement.com or call 1-844-685-4251 for the current status.
How much will I get?
Documented losses were reimbursed up to $5,000. The no-documentation cash payment is a pro rata share of what is left in the $14 million fund after fees, costs, monitoring and loss claims. It depends on how many people filed, and no figure has been published.
Is there a McLaren Health Care MyChart lawsuit?
There is a federal privacy suit, Wehrle v. McLaren Health Care Corporation, No. 25-cv-11420 in the Eastern District of Michigan. It alleges McLaren disclosed patient information to third parties without consent, and we found no settlement and no claim form. The last court record we could confirm is from 2025, so check the docket for its current status.
What is McLaren's patient portal called?
McLaren's portal is called My McLaren Chart. If a tracking settlement is ever reached, how you used the website or the portal would be the relevant question. Our form on this page asks exactly that.
How many people were affected by the McLaren Health Care data breach?
Per HIPAA Journal, 2,103,881 people in the 2023 attack and 743,131 in the 2024 attack. Together that is more than 2.8 million patients and employees, with some overlap possible.
What is worth doing now?
If you filed a claim, keep your confirmation and watch for the payment and the monitoring code. Either way, freeze your credit at all three bureaus, since Social Security numbers were exposed. Also read your insurer's explanation-of-benefits statements for care you never received.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
MyChart Class Actions in Michigan
Tracking cases against Michigan health systems in one place
Corewell Health MyChart Lawsuit
Another Michigan health system and where its cases stand
Data Breach Settlement Calculator
Estimate what a breach settlement pays per person
Open Class Action Settlements
Settlements still taking claims right now