11 September 2026: Lansing Urgent Care discovered that an unknown third party accessed and exposed certain data. File review is ongoing. Census unpublished. See the Lansing Urgent Care breach record.
The practice website notice is the primary source. HIPAA Journal on 13 November noted INC Ransom had listed the clinic. Treat that brand as unverified on top of the confirmed access. Helpline 844-573-1119. 505 N Clippert St, Lansing, MI 48912.
What happened at Lansing Urgent Care?
Found on or about 11 September that certain data was accessed and exposed. The practice says it confirmed systems were secure and opened an investigation. It is still identifying at-risk data and matching it to people. Impacted people are to get mail with further instructions. HHS to be notified.
HIPAA Journal called this a likely ransomware event because of the INC Ransom listing. The practice notice does not name ransomware. Catalog company-confirmed access. Keep INC Ransom as an unverified attribution.
What data was exposed?
May include full name, address, SSN, date of birth, health insurance, and medical information including treatment, diagnosis and prescriptions, mix by person. Review ongoing. recordsAffected stays 0.
SSNs plus diagnoses plus prescriptions is a high-sensitivity mix if those fields survive the review. Freeze credit. Watch pharmacy mail.
The El Camino Health post is a finished 2026 health notice. This Lansing row is still counting.
Who is affected?
People whose information sat in the impacted files, still being matched. Michigan urgent-care patients are the obvious population. Staff identity files are unpublished. Someone who only visited after 11 September is not automatically in the window.
More on the practice is on the Lansing Urgent Care company page. Do not confuse this with Lansing Community College.
What should patients do?
- Watch the mail for instructions. Call 844-573-1119 with questions.
- Place a freeze if you think an SSN may be in clinic files.
- Monitor credit reports for 12 to 24 months, as the notice asks.
- Treat INC Ransom 'proof' pages as unverified.
- The clinic will not collect a CVV to restore a chart.
Do not download alleged clinic dumps. This catalog does not link them.
Did INC Ransom do this?
Unverified. The group listed the clinic. The practice confirms access and exposure by an unknown third party. It does not, on the website notice, name that brand.
Actor listings are catalogued as claims until the clinic or a regulator names them. The confirmed fact is the 11 September discovery.
Frequently asked questions
How many people were affected?
Unpublished. File review ongoing. recordsAffected stays 0.
When did this happen?
Discovered on or about 11 September 2026.
Were Social Security numbers involved?
SSN is on the possible field list. Mix varies and the review is unfinished.
INC Ransom?
Listed the clinic. Unverified attribution on a confirmed incident.
Is this Lansing Community College?
No. Lansing Urgent Care, PLC, 505 N Clippert St.
Sourcing note: Practice website notice, HIPAA Journal 13 November 2026, INC Ransom listing as unverified.
Do not download alleged Lansing Urgent Care dumps. This catalog does not link them. A later leak-site post is still an unverified brand until Lansing Urgent Care names it.
Compare later mail with lansingurgentcare.com. Lansing Urgent Care will not ask for a card CVV or a one-time code through a new website to finish this investigation.
Do not merge this row with Lansing Community College. They are separate catalog files even when they share a season or a vendor class.
If you did not receive a letter, you may still be in an unpublished state filing. Ask Lansing Urgent Care in writing whether your identifier sits in the reached file.
US residents can place a free credit freeze at Equifax, Experian and TransUnion. Use the local freeze or watch process named in the notice if you live elsewhere.
Keep the paper letter if one arrives. A later amendment can add fields or a higher census. This catalog will move recordsAffected only when a named official source publishes a new figure. Do not treat a class-action advertisement as a census.
If two organisations share a similar name, read the company page before you enrol in monitoring. Wrong-firm sign-up pages are a common follow-on scam after a widely reported notice.
People who already froze credit last year should still read the new letter, because the field mix may differ this time. A freeze stays in place until you lift it.