MHCC Settlement: What It Was, and Why You Can No Longer File
MHCC is McLaren Health Care Corporation, and the settlement is a $14 million resolution of two data breaches affecting an estimated 2.8 million people. Checked August 22, 2026: the claim deadline was April 29, 2026, and it has passed.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened
McLaren Health Care Corporation, a Michigan-based hospital network, was sued in a class action alleging it failed to protect patients' sensitive personal and medical information across two separate data breaches: one between July 28 and August 23, 2023, and a second between July 17 and August 3, 2024. Two breaches in consecutive years at the same organisation is what gave the litigation its force. McLaren agreed to a $14 million settlement without admitting wrongdoing. The breaches are estimated to have affected around 2.8 million people — current and former patients, and others whose information the organisation held.
Case Details
The settlement was administered under court supervision through mhccsettlement.com, the court-authorised administrator's website. The final approval hearing was held on April 21, 2026, and the claim deadline fell eight days later. As with all class settlements, the court's role was to decide whether the terms were fair to class members who were not personally represented in the negotiation.
Status, Checked August 22, 2026 — Claims Are Closed
Who Was Covered
Current and former patients and other individuals whose personal information was compromised in the 2023 or 2024 McLaren Health Care breaches. Class members who filed were eligible for a one-time cash payment of up to $5,000, with the higher amounts requiring documentation of losses actually traceable to the breach — the ordinary structure in data breach settlements, where a small documented-loss tier sits above a much larger flat-payment tier. The practical point for anyone reading this now is that eligibility is no longer the operative question; the deadline is.
What $5,000 Actually Meant
How This Case Moved
- 1
July 28 - August 23, 2023 — the first breach
Unauthorised access to McLaren Health Care systems holding patient information.
- 2
July 17 - August 3, 2024 — the second breach
A separate incident the following year. Two breaches in consecutive years at the same organisation became central to the negligence allegations.
- 3
Class action and settlement
Claims consolidated into a class action alleging failure to protect sensitive information. McLaren agreed to a $14 million fund without admitting wrongdoing.
- 4
Notice and claims period
Class members were notified and could file for up to $5,000, with the larger amounts requiring documentation of losses traceable to the breaches.
- 5
April 21, 2026 — final approval hearing
The court considered whether the settlement terms were fair, reasonable and adequate for the class.
- 6
April 29, 2026 — claims close
The final day to submit a claim. Nearly four months later, the period remains closed and has not been reopened.
What to Watch For Now That Claims Are Closed
A closed settlement with millions of affected people is a standing target for impersonation. Three things to know:
Any site offering an MHCC claim form today
The window closed on April 29, 2026. A page offering to file your claim now is either describing a different case or is collecting your details for something that is not a settlement.
Calls or emails asking you to verify identity for payment
In a data breach settlement, being asked to hand over more personal data to receive compensation for a data breach should stop you immediately. The genuine administrator communicates through the court-approved address and does not need your full account credentials.
The real risk is unchanged
Medical and personal data from these breaches remains in circulation regardless of the settlement. Free credit freezes at all three bureaus, and checking explanation-of-benefits statements for care you did not receive, remain worthwhile — the settlement did not undo the exposure.
Questions People Actually Ask
What does MHCC stand for?
McLaren Health Care Corporation, a hospital network based in Michigan. The abbreviation is used on the settlement website and in most coverage, which is why the search term appears without the full name attached.
Can I still file a claim?
No. The deadline was April 29, 2026 and has passed. Claim periods are almost never reopened, and no third party can file late on your behalf, whatever a website may suggest.
I filed. When do I get paid?
Payment follows final approval and the resolution of any appeals, then administration. Data breach settlements commonly take many months from approval to distribution. Questions about a filed claim go to the settlement administrator, not to McLaren.
How much did people receive?
Up to $5,000 for documented losses traceable to the breaches, with a flat payment for everyone else. The flat amount depended on how many valid claims were filed against the $14 million fund, less administration costs and fees — with an estimated 2.8 million people affected, the maximum was never the typical payment.
Was I affected?
The breaches involved current and former McLaren Health Care patients and others whose data the organisation held, between July and August 2023 and again in July and August 2024. Notice was sent to identified class members. Since claims are closed, the practical question now is protective rather than financial.
What should I do if my data was exposed?
Place free credit freezes at Equifax, Experian and TransUnion, review explanation-of-benefits statements for treatment you did not receive, and watch for accounts opened in your name. Medical identity theft is harder to detect than financial fraud because the first sign is often a bill or a record error.
Is there another lawsuit I can join?
This settlement resolved the class claims for the 2023 and 2024 breaches, and class members who did not opt out are generally bound by it whether or not they filed. A new incident would be a separate matter — but nothing currently open covers these two breaches.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.