Massive Medical Records Breach Exposes 300,000 Patients, Including Michigan Medicine Patients A sophisticated cyber scheme has compromised nearly 300,000 medical records, including those of 551 Michigan Medicine patients, after a network of fraudulent entities posed as legitimate healthcare providers to access sensitive data. The breach, which occurred between October 18, 2023, and November 12, 2025, was uncovered when Epic Systems Corp. the vendor behind Michigan Medicine’s electronic health records detected unusual activity from third-party companies exploiting a health information exchange. The exposed data included demographic details (names, addresses, dates of birth), clinical information (diagnoses, medications, test results), and health insurance records, though Social Security numbers were not accessed. The breach stemmed from a coordinated effort by entities like Mammoth, RavillaMed, and GuardDog Telehealth, which allegedly used fake websites, shell companies, and fraudulent National Provider Identification (NPI) numbers to deceive healthcare systems into releasing records. Epic filed a lawsuit on January 13, 2026, in the U.S. District Court for the Central District of California, accusing Health Gorilla Inc. a health information network of enabling the scheme. The complaint alleges that Health Gorilla’s network monetized patient data without consent, including selling it to lawyers for class-action recruitment, and inserted false entries into medical records to mask their activities. The lawsuit compares the operation to a Hydra, with new fraudulent entities emerging as others are exposed. Michigan Medicine, along with Trinity Health, Reid Health, UMass Memorial Health, and OCHIN, joined the legal action. An internal review conducted March 12–25, 2026, confirmed unauthorized access to patient records, though the health system assessed the risk of identity or medical theft as low due to the absence of financial or Social Security data. Michigan Medicine has since reported the incident to regulators, is monitoring the lawsuit, and has notified affected patients, advising them to review insurance statements for suspicious activity. Health Gorilla denies the allegations, calling Epic’s lawsuit "misleading and unfounded" and stating it suspended connections with the implicated entities upon discovery. CEO Bob Watson criticized Epic’s response as irresponsible, vowing to defend against the claims. The breach highlights vulnerabilities in health information exchanges, with Epic reporting that additional records from other U.S. providers, including the Department of Veterans Affairs, may have been compromised. The full scope of the incident remains under investigation.

Michigan Medicine was targeted in a cyber attack after that experienced intermittent problems with its public websites as a result on a third-party vendor they used to host some of their sites. They worked with the third-party to mitigate it and expect to have sites fully functional as soon as possible. Public websites hosted by a third-party provider are the only websites that have been targeted. All patient information is secure and not included on any of the compromised sites. Michigan Medicine took steps immediately to investigate the matter and implemented additional safeguards to reduce risk to our patients.

On November 10, 2022, the Vermont Office of the Attorney General reported a data breach involving Michigan Medicine that occurred from August 15 to August 23, 2022, due to a phishing attack targeting its employees. The breach potentially exposed identifiable patient information, including names, medical record numbers, addresses, dates of birth, and health insurance information; however, the specific number of individuals affected is unknown.

The patient information of Michigan Medicine was leaked in a data security incident after an employee email account was compromised. A newly-hired employee accessed patients' electronic medical records of about 2,920 patients without any business need. The compromised information included demographic and clinical information such as diagnosis, treatment, and test results. The employee's excess was immediately cut off and further investigation revealed that no information was misused and the employee checked the records out of curiosity.

Michigan Medicine notified approximately 5,500 patients about a phishing email campaign that have exposed some of their health information. During the campaign, emails containing a malicious link were sent to over 3,200 Michigan Medicine employees. This email was opened by three employees, giving the attacker access to their email accounts. The compromised information includes names, medical record numbers, addresses, dates of birth, diagnostic and treatment information, and health insurance information. As soon as Michigan Medicine learned that the email accounts were compromised, they were disabled so no further access could take place until the passwords were changed.