Nearly 280,000 additional Maine residents affected by Covenant Health data breach

ANDOVER, Mass. (WMTW) - A health care network now says hundreds of thousands more Maine residents have been impacted by a data breach that happened nearly eight months ago.

Massachusetts-based Covenant Health, which owns the St. Mary’s Health System in Lewiston and St. Joseph Healthcare in Bangor, said it was initially alerted to unusual information technology (IT) activity on May 26, 2025.

St. Mary’s Health and St. Joseph Healthcare both reported IT issues in late May that affected phones and documentation systems, and that some services were intermittently unavailable. Covenant Health worked to secure and restore its systems, and brought in third-party IT and forensic specialists to investigate the source and extent of the incident.

Through the investigation, Covenant Health learned a hacker gained access to its IT system on May 18, 2025, and was able to access certain patient information belonging to the health care network and its affiliated entities. Covenant Health said the personal information potentially involved varied by patient, but included patient names and one or more of the following: addresses, dates of birth, medical record numbers, Social Security numbers, health insurance information and treatment information, such as diagnoses, dates of treatment and type of treatment.

On July 11, 2025, Covenant Health notified people who were potentially impacted by the data breach. According to a data breach notice filed with the Maine Attorney General’s Office on that day, Covenant Health reported that 7,864 people were affected by the data breach, including 4,659 Maine residents.

On Dec. 31, 2025, Covenant Health announced that additional patient information may have been involved in the data breach, sent notification letters to the affected people and filed another notice with the Maine Attorney General’s Office. The updated notice indicates 478,188 people were affected by the breach, including 284,529 Maine residents.

Covenant Health said people whose information may have been compromised should review the statements they receive from their health care providers and health insurance plans. If people see any services they did not receive, they should immediately contact their provider or insurance company. Covenant Health also said it is offering complimentary credit monitoring and identity theft protection services to people whose Social Security numbers may have been involved.

Any patient who believes their personal information was involved and has questions about the data breach should call 1-855-361-0344 between 9 a.m. and 9 p.m. Monday through Friday, excluding major U.S. holidays.

In June 2025, a class action lawsuit was filed against Covenant Health and Bangor’s St. Joseph Hospital over the data breach. The lawsuit accused Covenant Health and the hospital of failing to properly protect patients’ private information.

In its Dec. 31 statement, Covenant Health said it has enhanced the security of its IT system to help prevent a similar data breach from happening again.

Covenant Health has facilities in Maine, Massachusetts, New Hampshire, Rhode Island and Pennsylvania.

In addition to St. Mary’s Health System and St. Joseph Healthcare, Covenant Health owns St. André Health Care in Biddeford and the Bangor Nursing and Rehabilitation Center.