Covenant Health Settles Data Breach Case for $2 Million
The health system agrees to a settlement following a 2025 cyberattack that exposed the personal data of thousands of patients.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust local healthcare providers to adequately protect your sensitive digital health information?
Covenant Health has agreed to pay a $2 million settlement to resolve a class action lawsuit filed after an unauthorized party accessed its IT network. The breach, which was discovered in July 2025, compromised the sensitive information of more than 500,000 patients.
Why it matters
Patients initiated the lawsuit alleging that the health system failed to adequately protect their private records. The settlement provides a pathway for affected individuals to seek compensation for damages resulting from the exposure of their personal and medical data.
The settlement impacts at least 284,000 Maine residents whose Social Security numbers and treatment details were compromised. Claimants may be eligible for cash payments of up to $5,000 or a $75 payment paired with credit monitoring services.
The players
Covenant Health
This health system operates various medical facilities and services across Maine and New England.
Penobscot County Superior Court
This is the judicial body responsible for overseeing the legal proceedings and final settlement approval.
The details
The breach occurred in May 2025 when an unauthorized party gained entry to the health system's network. Covenant Health has entered into this agreement without admitting to any liability or wrongdoing.
Timeline
The IT network was accessed by an unauthorized party in May 2025.
Covenant Health discovered the data breach in July 2025.
Patients must submit their claims for compensation by December 30, 2026.
A final approval hearing for the settlement is scheduled for 2027.
The Tech Race
This settlement follows the pattern established by the Central Maine Healthcare data breach settlement. It highlights the growing legal and financial risks healthcare systems face as they defend sensitive patient data against increasingly sophisticated cyberattacks.
Impacted patients can now begin the process of submitting claims online or by mail for their documented losses. Those who qualify should ensure their submissions are completed by the December 30, 2026 deadline to receive compensation or credit monitoring.
The takeaway
Affected individuals should verify their eligibility status and gather necessary documentation for their claims before the end of next year. Staying vigilant with credit monitoring remains a crucial step for anyone who has had their Social Security number exposed in a medical breach.
What happens next
A final court hearing is scheduled for 2027 at the Penobscot County Superior Court to determine the final approval of the settlement terms.
Further reading
For more information on digital security trends, visit Cybersecurity.
Source note: This article includes information reported by Lewiston Sun Journal.
Live Poll
Do you trust local healthcare providers to adequately protect your sensitive digital health information?
