Covenant Health, a nonprofit health system serving communities across New England, has announced a large-scale data breach affecting hundreds of thousands of patients. The breach stemmed from an external hacking event, where unauthorized parties infiltrated the organization’s IT systems and gained access to sensitive patient information. Covenant Health experienced a cybersecurity breach in May 2025, exposing sensitive patient information including Social Security numbers, treatment records, and more.
Covenant Health’s Data Breach Investigation
The intrusion occurred on May 18, 2025, and was discovered on May 26, 2025, when Covenant Health detected unusual activity in its IT environment. Cybersecurity experts were immediately brought in to investigate and contain the incident. Affected systems were secured, and a thorough forensic investigation was launched to determine the scope of the breach.
According to disclosures filed with state regulators, the breach impacted 478,188 individuals, including 284,529 Maine residents. The compromised data includes a combination of personal identifiers and health information—an especially concerning combination that increases the risk of medical identity theft and financial fraud.
The breach involved data from Covenant Health and one of its affiliated entities, and included names, addresses, dates of birth, Social Security numbers, medical record numbers, health insurance details, and treatment-related information such as diagnoses and service dates.
In response, Covenant Health has notified impacted individuals via mail and has offered a complimentary one-year membership to Experian® IdentityWorksSM, which includes credit monitoring and identity protection services. The health system also reported the breach to federal and state authorities and claims to have strengthened its cybersecurity protocols to help prevent future incidents.
Despite these efforts, the scope of the exposed data and the length of time the unauthorized party had access to Covenant’s systems raises serious concerns. Healthcare data is particularly valuable on the dark web, and victims may face long-term risks. Patients impacted by this breach have legal rights and may be eligible for financial compensation through a class action lawsuit.
When Did This Breach Occur?
-
Date of Breach: May 18, 2025
-
Date Discovered: May 26, 2025
-
Notifications Mailed: December 31, 2025
What Information Was Breached?
What You Can Do
If you received a breach notice from Covenant Health or suspect your information was involved, here are key steps to take:
-
Enroll in IdentityWorks: Activate the one-year free identity monitoring provided by Covenant Health via Experian IdentityWorksSM. It can help detect and respond to identity theft quickly.
-
Monitor Accounts: Check your bank, insurance, and credit accounts regularly for signs of suspicious activity.
-
Credit Freeze: Place a freeze with major credit bureaus to prevent unauthorized credit applications.
-
Medical Records Review: Request and review your medical records to ensure no unauthorized treatment or services have been billed under your name.
-
Report Fraud: If you notice anything suspicious, report it to the FTC, your insurance provider, or law enforcement.
Class Action U is here to support individuals who may feel overwhelmed by this breach. You don’t have to handle this alone—your voice matters, and you may have legal options.
File a Data Breach Lawsuit Against Covenant Health
If you were affected by the Covenant Health breach and received a letter or notification, you may be eligible to join a class action lawsuit. When healthcare organizations fail to protect private data, patients deserve justice and compensation.
Class action lawsuits give people the power to stand together against large institutions that fail to uphold their duty to safeguard sensitive information. By joining, you may be able to recover financial compensation for your time, risk, and any harm experienced.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
