MyMichigan Health Data Breach

metaencryptor has claimed MyMichigan Health, a healthcare organization based in the United States, on its dark web portal on October 12, 2026. This claim is part of metaencryptor’s ongoing campaign, which has targeted 27 organizations over the past 60 days. MyMichigan Health has not yet released a public statement regarding the incident. The inclusion of U.S. healthcare organizations is a notable trend in metaencryptor’s recent activities. The metaencryptor ransomware group’s campaign, spanning 60 days and encompassing 27 victims, predominantly targets the Manufacturing, Healthcare, and Technology sectors. The group’s operations are geographically concentrated in the U.S., Japan, and South Korea. Notable co-victims identified in this period include VIATechnik (U.S., Technology), ENKA Schools (Turkey, Education), and Onsemi (U.S., Manufacturing). The consistent targeting of U.S. healthcare organizations aligns with metaencryptor’s pattern.

Stealer-log analysis indicated credential activity consistent with workstation compromises affecting personnel who access MyMichigan Health’s platforms. However, no corporate-domain employee credentials were confirmed within the sampled data. The observed endpoint compromise profile suggests that an infected workstation logged credentials across multiple services, potentially granting access to healthcare platform accounts. This evidence points towards credentials harvested via personal email aliases or SaaS accounts, rather than direct corporate-domain breaches. The query returned indirect credential records, not confirmed corporate ones, underscoring the importance of considering various access vectors. The absence of direct corporate-domain hits does not rule out a compromise; it simply reflects the specific data captured in the analyzed stealer logs. The evidence suggests that if a compromise occurred, it may have originated from compromised individual user accounts, possibly linked to personal email aliases or cloud service credentials. Healthcare providers targeted by ransomware groups like metaencryptor should conduct thorough credential sweeps across personal email aliases and non-corporate SaaS accounts used by clinical staff, in addition to corporate-domain accounts. Implementing phishing-resistant multi-factor authentication (MFA) across all remote access and clinical identity systems is crucial. The observed indirect credential evidence necessitates a comprehensive review of internal logs, treating the stealer-log signal as an indicator of workstation-level compromise.