44North Data Breach 2026: 2,158 Michigan Employee Health Plan Members Exposed via Ransomware. Acrisure Subsidiary. What To Do

What happened

44North is a Cadillac, Michigan firm and one of Michigan’s few dually-licensed third-party administrator (TPA) and insurance broker organizations. Services include employee benefits consulting, self-funded plan administration, claims administration, HSA/HRA, and life and disability insurance. 44North was acquired by Acrisure and now operates as Acrisure Great Lakes.

Because 44North handles claims for self-funded employer health plans, it is a HIPAA business associate of those plans — which is why a breach involving plan participant data appears on the OCR portal.

On May 6, 2025, 44North discovered a ransomware attack. After approximately 9 months of containment, forensic review, and individual identification, 44North mailed notification letters and filed with HHS OCR on February 16, 2026 — confirming 2,158 affected individuals.

On March 11, 2026, Cole & Van Note opened a class action investigation. As of retrieval the investigation page is closed to new clients, which often indicates a filing is imminent.

The “Desktop Computer” location code on the OCR portal is unusual and likely reflects a single endpoint compromise (workstation or laptop) where the affected plan participants’ PHI happened to be stored.

The Cole & Van Note coverage references “Silent Ransom Group” attribution, but Silent Ransom Group typically targets law firms — this attribution has not been independently corroborated and should be treated as unconfirmed.

What was stolen

Public sources cite only “names and other personal identifiers.” Given 44North’s TPA role, the exposed data set very likely includes:

• Social Security number
• Date of birth
• Health plan member ID
• Claims and treatment information
• Possible diagnosis codes

These specifics are not visible in publicly indexed reporting. Read your specific notification letter carefully for the exact data elements involved in your case.

What 44North is offering

• Kroll credit monitoring with unlimited fraud specialist consultation
• Duration not explicitly confirmed for this incident — a separate prior Acrisure Mass AG filing (#31161, December 2023) offered 1-2 years Kroll with $1M ID fraud reimbursement, Web Watcher, Public Persona, and Quick Cash Scan. The 2026 incident likely includes a similar package, but verify against your letter.

What to do

1. Read your specific notification letter to confirm what data elements were involved and the exact Kroll monitoring terms offered.
2. Enroll in Kroll monitoring through the activation code in your letter.
3. Place free credit freezes at Equifax, Experian, TransUnion. SSN exposure is likely given the TPA context.
4. File IRS Form 14039.
5. If you are an employee of a 44North / Acrisure Great Lakes client company, ask your HR team whether your plan was in scope.
6. Stop the ongoing flow of your health plan data. HealthConsent files HIPAA restriction requests covering TPA and benefits-broker pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches