Massive Medical Records Breach Exposes 300,000 Patients, Including Michigan Medicine Patients A sophisticated cyber scheme has compromised nearly 300,000 medical records, including those of 551 Michigan Medicine patients, after a network of fraudulent entities posed as legitimate healthcare providers to access sensitive data. The breach, which occurred between October 18, 2023, and November 12, 2025, was uncovered when Epic Systems Corp. the vendor behind Michigan Medicine’s electronic health records detected unusual activity from third-party companies exploiting a health information exchange. The exposed data included demographic details (names, addresses, dates of birth), clinical information (diagnoses, medications, test results), and health insurance records, though Social Security numbers were not accessed. The breach stemmed from a coordinated effort by entities like Mammoth, RavillaMed, and GuardDog Telehealth, which allegedly used fake websites, shell companies, and fraudulent National Provider Identification (NPI) numbers to deceive healthcare systems into releasing records. Epic filed a lawsuit on January 13, 2026, in the U.S. District Court for the Central District of California, accusing Health Gorilla Inc. a health information network of enabling the scheme. The complaint alleges that Health Gorilla’s network monetized patient data without consent, including selling it to lawyers for class-action recruitment, and inserted false entries into medical records to mask their activities. The lawsuit compares the operation to a Hydra, with new fraudulent entities emerging as others are exposed. Michigan Medicine, along with Trinity Health, Reid Health, UMass Memorial Health, and OCHIN, joined the legal action. An internal review conducted March 12–25, 2026, confirmed unauthorized access to patient records, though the health system assessed the risk of identity or medical theft as low due to the absence of financial or Social Security data. Michigan Medicine has since reported the incident to regulators, is monitoring the lawsuit, and has notified affected patients, advising them to review insurance statements for suspicious activity. Health Gorilla denies the allegations, calling Epic’s lawsuit "misleading and unfounded" and stating it suspended connections with the implicated entities upon discovery. CEO Bob Watson criticized Epic’s response as irresponsible, vowing to defend against the claims. The breach highlights vulnerabilities in health information exchanges, with Epic reporting that additional records from other U.S. providers, including the Department of Veterans Affairs, may have been compromised. The full scope of the incident remains under investigation.