MyMichigan Health Data Breach Lawsuit: A Hacker Claim, Not Yet a Confirmed Breach
Reference Guide
On October 12, 2026 a ransomware group listed MyMichigan Health on its leak site. MyMichigan says its investigation, run with Mandiant and law enforcement, has so far found no evidence that its systems or patient information were compromised. As of October 17, 2026 there is no breach notice, no affected-patient count, no lawsuit over the claim and no settlement.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Claimed
MyMichigan Health is a non-profit health system headquartered in Midland, affiliated with Michigan Medicine, with medical centers across a 26-county region of central and northern Michigan — Alma, Alpena, Clare, Gladwin, Midland, Mt. Pleasant, Saginaw, Sault Ste. Marie, Standish, Tawas City and West Branch.
The tracking site Ransomware.live shows MyMichigan Health as a victim claimed by a group calling itself MetaEncryptor, discovered on October 12, 2026. That is the date of the listing, not a confirmed date of any intrusion.
In a statement released October 15, 2026, MyMichigan said it immediately opened an investigation, engaged the incident response firm Mandiant and is working with law enforcement. According to the statement, the investigation has not found evidence of unauthorized access to its systems or compromise of patient information, and the group has not provided supporting evidence, including sample files. Everything about stolen data is, so far, the group’s claim.
Case details
No lawsuit over the MetaEncryptor claim had been found as of October 17, 2026. A search of federal dockets for MyMichigan Health turns up three earlier cases in the U.S. District Court for the Eastern District of Michigan, all filed before the October 12 listing, so none of them can be about it:
Moffit v. MyMichigan Health, No. 1:25-cv-10761, filed March 18, 2025 — an ERISA retirement-plan suit (see below).
Pregizer v. MyMichigan Health, No. 1:25-cv-11374, filed May 12, 2025, classified as an other-statutory action; a motion to dismiss was granted in part and denied in part on January 26, 2026.
Clark v. MyMichigan Health, No. 1:26-cv-12452, filed July 17, 2026, with an order on a motion to dismiss entered October 13, 2026.
We could not confirm the subject matter of Pregizer or Clark from the docket, so we do not describe them here. State-court filings were not searched.
Status: Unconfirmed Claim, No Breach Lawsuit
Law-firm “investigations” are not court cases: an investigation is a firm looking for clients. If MyMichigan later confirms that patient information was taken, federal rules require individual notice, and a filed lawsuit would show up on a court docket with a case number.
Latest From the Court Docket
Recent entries in the federal cases behind this page, taken from the court's own docket. We check it at least once a day; this list is as of Oct 17, 2026.
Oct 14, 2026
For Order
Moffit et al v. MyMichigan Health et al, No. 1:25-cv-10761 (E.D. Mich.), ECF No. 52
Oct 13, 2026
Order on Motion to Dismiss
Clark v. MyMichigan Health et al, No. 1:26-cv-12452 (E.D. Mich.), ECF No. 25
Both dockets with recent entries
Moffit et al v. MyMichigan Health et al
No. 1:25-cv-10761 · E.D. Mich. · latest entry Oct 14, 2026
Find this docket on CourtListenerClark v. MyMichigan Health et al
No. 1:26-cv-12452 · E.D. Mich. · latest entry Oct 13, 2026
Find this docket on CourtListener
A docket entry is a step in the case, not a decision on who wins. Sources: the courts' PACER feeds and CourtListener (Free Law Project). Not legal advice.
Who Could Be Affected
Nobody has been confirmed as affected. MyMichigan’s statement refers to its patients, employees and communities; as of August 2023, the system had more than 13,200 employees, volunteers and physicians.
The practical test is your mail. Under HIPAA, a hospital that confirms a breach of health information must notify each affected person without unreasonable delay and no later than 60 calendar days after discovery. A breach involving 500 or more people must also be reported to the U.S. Department of Health and Human Services at the same time. No letter means no confirmed exposure yet — not that you are in the clear forever.
Is There Any Money?
The one MyMichigan settlement that does exist is unrelated: a $1.9 million deal in the retirement-plan suit Moffit v. MyMichigan Health, which received initial court approval on June 12, 2026. It concerns how a stable value investment in the employee retirement plan performed. It has nothing to do with patient data.
MyMichigan Health Timeline
March 18, 2025 — Retirement-Plan Suit Filed
Moffit v. MyMichigan Health (1:25-cv-10761) is filed in the Eastern District of Michigan under ERISA. It is about the employee retirement plan, not data.
June 12, 2026 — $1.9 Million Retirement Deal Gets Initial OK
A federal judge grants initial approval to the $1.9 million settlement in Moffit. This is the only MyMichigan settlement on record.
October 12, 2026 — Leak-Site Listing
Ransomware.live records MyMichigan Health as a victim claimed by MetaEncryptor. The listing date is not a confirmed intrusion date.
October 15, 2026 — MyMichigan Responds
MyMichigan says it is investigating with Mandiant and law enforcement and has found no evidence of unauthorized access or compromised patient information so far.
October 17, 2026 — Still Unconfirmed
No breach notice, no affected-patient count, no lawsuit over the claim and no settlement. The investigation is ongoing.
Three Things to Watch For
A hacker claim with no confirmed breach is an ideal cover story for imposters:
“Your MyMichigan data was leaked — verify now”
MyMichigan has not confirmed any data loss. A text or email asking you to log in, confirm your insurance or enter your Social Security number to “check” the leak is phishing. Use the patient portal or phone number you already have, not a link.
“Claim your MyMichigan settlement”
There is no data breach settlement. The only real MyMichigan settlement is the retirement-plan case, which covers plan participants, not patients. Anyone collecting fees or personal data for a breach payout is inventing one.
Calls offering to buy back or delete your records
Ransomware groups and copycats sometimes contact individuals directly. Do not pay or share information; report the contact to MyMichigan and to law enforcement.
MyMichigan Health Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Was MyMichigan Health actually hacked?
Not confirmed. A group calling itself MetaEncryptor claimed it, and the listing was recorded on October 12, 2026. MyMichigan’s October 15 statement says its investigation has found no evidence of unauthorized access or compromised patient information so far, and the group has not provided sample files.
Is there a MyMichigan Health data breach lawsuit?
Not over this claim, as of October 17, 2026. The federal cases against MyMichigan Health on record were all filed before the October 12 listing, including a retirement-plan suit. A law firm “investigation” is not a lawsuit.
What data was taken?
No one has established that any data was taken. MyMichigan has not confirmed any data categories, and the group has not provided sample files. If a breach is confirmed, each notice letter will list the information involved for that person.
Will I get a letter if my information was exposed?
Yes. HIPAA requires notice to each affected person without unreasonable delay and no later than 60 calendar days after a breach is discovered, and a breach of 500 or more people must also be reported to HHS. Keep any letter you receive.
What is the $1.9 million MyMichigan settlement I have seen?
That is Moffit v. MyMichigan Health, No. 1:25-cv-10761, an ERISA case about a stable value investment in the employee retirement plan. The $1.9 million deal got initial approval on June 12, 2026. It is unrelated to the hacking claim and does not cover patients.
Can you sue a hospital for a data breach?
Patients do file class actions against health systems after confirmed breaches — see our Change Healthcare page for one example. For MyMichigan, there is not yet a confirmed breach to sue over. Separate MyChart-related matters at other systems, such as UCLA Health and Yale New Haven Health, are covered on their own pages.
Is there a class action lawsuit against Change Healthcare for data breach?
That is a different breach at a different company, and this page does not cover it. Our Change Healthcare data breach lawsuit page tracks that case.
What is worth doing right now?
Ignore unsolicited messages about the leak, keep your MyMichigan portal password unique, and watch your insurer’s explanation-of-benefits statements for care you never received. A credit freeze is free and reversible if you want extra protection. If a notice letter arrives, keep it.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Change Healthcare Data BreachA separate health-data breach with its own litigation
- Corewell Health MyChart LawsuitA separate matter at another Michigan health system
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines