Covenant Health Data Breach Claimants Gain Settlement
Patients may now claim up to $5,000 for losses related to the 2025 security incident that exposed 500,000 records.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust local healthcare providers to adequately protect your sensitive digital health information?
Covenant Health has agreed to a $2 million settlement following a May 2025 data breach that exposed the personal information of more than 500,000 patients. At least 284,000 Maine residents were among those affected by the unauthorized network access.
Why it matters
The settlement highlights the growing legal and financial risks healthcare organizations face when IT networks fail to secure sensitive patient records. This case underscores the long-tail liability associated with cybersecurity incidents that compromise Social Security numbers and treatment histories.
The settlement provides $75 payments for those opting for credit monitoring or up to $5,000 for claimants who can document specific losses.
The players
Covenant Health
A healthcare provider operating facilities across Maine, including St. Joseph Healthcare and St. Mary's Regional Medical Center.
The details
Unauthorized parties gained access to the Covenant Health IT network in May 2025, an incident discovered two months later in July. The breach exposed sensitive identifiers, including Social Security numbers and medical treatment details. While the health system agreed to the $2 million payout, it explicitly noted that the agreement does not constitute an admission of liability or wrongdoing.
Timeline
May 2025: Unauthorized access to the IT network occurred.
July 2025: Covenant Health discovered the data breach.
December 30, 2026: Deadline for affected patients to submit claims.
2027: Final settlement approval hearing to be held in Penobscot County.
The Tech Race
The Covenant Health settlement follows the $1.3 million resolution established by Central Maine Healthcare. It highlights an escalating legal precedent for how Maine health systems must account for the failure to secure patient data against unauthorized network intrusion.
Patients impacted by the breach have until December 30, 2026, to submit claims for cash payments or credit monitoring services. Claimants must provide documentation of financial losses to qualify for the higher $5,000 tier of relief.
The takeaway
Healthcare systems in Maine now face heightened financial accountability for network security failures. Affected patients should monitor their personal records for identity theft and track the 2027 Penobscot County court hearing for final settlement details.
What happens next
A final approval hearing for the class action settlement is scheduled to take place in the Penobscot County Superior Court in 2027.
Further reading
For broader trends in regional data protection, visit our section on Cybersecurity.
Source note: This article includes information reported by Lewiston Sun Journal.
Live Poll
Do you trust local healthcare providers to adequately protect your sensitive digital health information?
