Cyber-attack puts more than one million Michigan residents at risk

METRO DETROIT – More than a million Michigan residents may be at risk of having their data leaked following a cyber-attack against a software company contracted by Corewell Health.

This cybersecurity breach target Welltok, Inc., the software company contracted to provide communications services to Corewell Health’s southeastern Michigan properties. The office of Michigan Attorney General Dana Nessel stated the names, dates of birth, email addresses, phone numbers, medical diagnoses, health insurance information, and Social Security numbers for about one million Corewell Health patients were compromised in the breach.

Additionally, the names, addresses, and health insurance identification numbers of 2,500 users of the healthy lifestyle portal for Priority Health, an insurance plan owned by Corewell, were also compromised, according to a statement from the health system earlier this month. In total, the breach affected nearly 8.5 people nationally.

The attack, which occurred on May 30, exploited software vulnerabilities on the MOVEit Transfer server owned by Virgin Pulse, Welltok's parent company.

According to the HIPAA Journal, this cyberattack marks the fourth-largest healthcare data breach in the U.S. this year. The U.S. Department of Health and Human Services reported that data breaches among healthcare organizations more than doubled from 2019 to 2021. In 2022, at least 28.5 million healthcare records were breached nationwide.

Michigan, in particular, has experienced a surge in healthcare-related cyberattacks. In the last year, a ransomware attack affected 2.5 million McLaren Health Care patients. Similarly, the University of Michigan faced a cyberattack in late August, leading to the compromise of personal information, including Social Security numbers, driver’s license or other government-issued ID numbers, and medical records.

If Welltok has a valid mailing address on file, the company is mailing a notice letter to individuals whose information was determined to be in the affected files. Anyone who did not receive a notice letter but would like to know if they were affected, or has other questions, may call the Welltok dedicated assistance line at (800)-628-2141.