AG Nessel Reissues Consumer Alert on Data Breaches Following Cyber Incident Compromising Information of Northern Michigan Healthcare Patients

LANSING – Michigan Attorney General Dana Nessel is reissuing her consumer alert on data breaches following a recently revealed 2025 cyber incident that compromised information of patients of Munson Healthcare, a Traverse City-based healthcare system serving communities across Northern Michigan. The data breach involved unauthorized access through a third-party electronic health record vendor, Cerner. The incident compromised personal data, including patient names, Social Security numbers, and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment.  

While the number of impacted Michigan residents remains unknown to the Department of Attorney General, Munson Healthcare is notifying impacted patients by mail. Impacted consumers are being offered free credit monitoring for 24 months through Experian. Consumers may call 833-931-5700 for additional information.  

Attorney General Nessel has repeatedly advocated for strengthening Michigan law to require companies that experience a data breach to immediately inform her office. This would allow the Department of Attorney General to more quickly alert the public. Senate Bills 360-364, which aim to enhance protections against data breaches and identity theft, passed the Michigan Senate last year and await consideration before the Michigan House of Representatives. 

“Because Michigan law does not currently require companies to immediately notify my office when a data breach occurs, we often don’t know who was impacted or when until well after a concerning cyber incident,” Nessel said. “These delays put consumers at higher risk of identity theft, and our state needs stronger laws to better protect Michiganders from bad actors. I urge anyone who receives a notice that their personal information may have been compromised to consider taking advantage of the free credit monitoring resources being offered.” 

Consumers can protect themselves during a data breach by taking the following actions:  

• Watch out for phishing emails;
• Strengthen or change passwords;
• Do not retain unnecessary data or files;
• Use multifactor authentication on devices and accounts; and
• Review their credit report often. Take advantage of free weekly credit reports from each of the three main credit reporting agencies (Equifax, Experian, and TransUnion) by contacting the Annual Credit Report website. 

Consumers are also encouraged to consider taking action to put a freeze on their credit. This is especially important where Social Security numbers are accessed in a data breach, which is all too common. A credit freeze prevents creditors—such as banks or lenders—from accessing an individual’s credit reports. This will stop identity thieves from taking out new loans or credit cards in the consumer’s name because creditors will not approve their loans or credit requests if they cannot first access the consumer's credit reports. By law, a credit bureau must allow consumers to place, temporarily lift, or remove a credit freeze for free. Individuals will need to freeze their credit with each bureau: Equifax, Experian, and TransUnion. 

Nessel additionally wants consumers to understand the importance of protecting their medical information after a data breach and to recognize the warning signs that may indicate someone is using their information. Affected individuals should watch out for: 

• A bill from their doctor for services they didn’t receive.
• Errors in their Explanation of Benefits (EOB), like services they never received or medications they don’t take.
• Calls from debt collectors about medical bills they don’t owe.
• Medical debt collection notices on their credit report that they don’t recognize.
• A notice from their health insurance company saying they’ve reached their benefit limit.
• Denied insurance coverage due to a pre-existing condition they don’t have. 

To assist residents, Attorney General Nessel launched the Michigan Identity Theft Support System (MITS), which helps residents seeking to restore their stolen identities. When they believe their identity or personal information is in the hands of a fraudster, consumers should: 

• Review identity theft warning signs to determine if they may be a victim of identity theft.
• Determine which personal information may have been compromised.
• Contact their financial institution (e.g., bank, credit union, etc.).
• Check their credit report and put a freeze on their credit, if necessary.
• File a Federal Trade Commission (FTC) Identity Theft Report or police report.

If Michigan residents have completed the steps above and still need assistance, they can complete the MITS Request for Identity Theft Assistance form. 

To file a complaint with the Attorney General, or get additional information, contact: 

Consumer Protection Team
P.O. Box 30213
Lansing, MI 48909
517-335-7599
Fax: 517-241-3771
Toll-free: 877-765-8388
Online complaint form

###