McKenzie Health System Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have received care at McKenzie Health System, or who work there, face a practical question: whether internal files taken in a ransomware incident could include details that identify them or describe their medical history. Public reporting so far leaves the number of people affected and the precise contents of those files unconfirmed, which means individuals cannot yet know from official tallies alone whether their own information is involved.

What is known is that the organisation was listed by the AvosLocker ransomware group in late December 2022, with the group claiming that internal files had been exfiltrated. For patients and staff in a small regional health system, that claim alone is enough to warrant attention and basic protective steps while fuller details remain limited.

Inside the incident

On or about 26 December 2022, McKenzie Health System appeared on a leak site associated with the AvosLocker ransomware group. The available public summary states that internal files were exfiltrated in a ransomware attack. No confirmed figure has been released for the number of people whose data may be involved, and the exact method of initial access, the duration of any unauthorised presence on the network, and the full scope of systems affected have not been disclosed in the material provided.

Because the listing originates from the threat actor, it remains an unverified claim unless and until the organisation or independent investigators state the details. Public reporting at the time did not include statements from McKenzie Health System quantifying the incident or describing remediation steps. In short, the core facts on record are the organisation’s name, the reported date, the attribution to AvosLocker, and the description of internal files taken during a ransomware event; everything else is undisclosed.

The group behind it: avoslocker

AvosLocker is a ransomware operation that became active in the early 2020s and is known for double-extortion tactics. In typical campaigns the group encrypts systems and simultaneously steals data, then pressures victims by threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Affiliates have historically used a mix of phishing, exploitation of exposed remote-access services, and other common initial-access methods before deploying the ransomware payload.

The group has listed organisations across multiple sectors, including healthcare, on its leak site. Listings of this kind are claims by the actors themselves; they do not automatically prove that every file described was in fact taken or that every named organisation suffered the full impact asserted. In the case of McKenzie Health System, the public record consists of the listing and the accompanying assertion that internal files were exfiltrated; no further specific statements by AvosLocker about this victim are part of the facts at hand.

About McKenzie Health System

McKenzie Health System is a not-for-profit medical and surgical hospital based in Sandusky, Michigan, serving the surrounding region through the hospital itself and nine clinics. As a community healthcare provider it handles the ordinary range of clinical, administrative and operational information required to deliver inpatient and outpatient care, schedule appointments, bill insurers, and manage staff.

A breach at an organisation of this type is consequential because healthcare entities routinely hold sensitive personal and medical data. Even when the exact contents of stolen files remain unconfirmed, the mere possibility that clinical or administrative records left the network creates lasting concerns for patients, employees and the continuity of local care services. Smaller regional systems can also face particular operational strain after ransomware events, because specialised IT resources and backup capacity may be more limited than those of large hospital networks.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, dates of birth, medical record numbers, diagnoses, insurance details or employee records—has been publicly confirmed. Organisations of this kind typically maintain electronic health records, billing and insurance files, staff personnel data, and internal operational documents. Whether any or all of those categories were among the files claimed by AvosLocker is unconfirmed.

Until McKenzie Health System or regulators release a detailed notice, affected individuals cannot treat any particular data type as established fact. The prudent working assumption is that whatever internal material the attackers obtained could include personally identifiable or health-related information, but that remains an inference from the nature of the organisation rather than a verified disclosure.

Why it matters

For individuals, the real-world risks centre on identity theft, medical-identity fraud and targeted phishing. Stolen health or administrative data can be used to open fraudulent accounts, submit false insurance claims, or craft convincing messages that reference real appointments or providers. Even if the files prove to be purely operational, the uncertainty itself can leave people unsure whether to monitor credit reports, place fraud alerts, or watch for unusual medical bills.

For the organisation, a ransomware incident can disrupt clinical workflows, divert staff time to recovery and notification duties, and erode community trust. Healthcare providers also face regulatory obligations under laws that protect patient privacy; any confirmed exposure of protected health information can trigger notification requirements and potential oversight. Because the number of people affected remains unknown and the precise data types unconfirmed, both the personal and institutional consequences are still bounded by incomplete public information.

Were you affected?

If you have been a patient, employee or contractor of McKenzie Health System, treat the incident as a prompt for ordinary vigilance rather than panic. Concrete first steps include:

• Watch financial and insurance statements for unfamiliar charges or claims.
• Consider placing a free fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may have been involved.
• Be cautious of unsolicited calls, emails or texts that reference the hospital or claim to offer breach-related assistance.
• Request any official notification letters the organisation may issue; those remain the authoritative source for whether your specific records were implicated.
• Run a free exposure scan of your email address to check whether it has already appeared in other known breach data sets.

Public detail on this incident is limited. Further clarity will depend on any additional statements from McKenzie Health System or regulatory filings. Until then, the practical measures above remain the most direct way for individuals to reduce residual risk.

AICompiled with AI assistance from public sources and published under our editorial standards.