Covenant Health, Inc. Under Investigation for Data Breach of Over 470,000 Patient Records

Schubert Jonckheer & Kolbe LLP is investigating a data breach that led to unauthorized access to the sensitive information of 478,188 patients of Covenant Health, Inc. (“Covenant”), a Massachusetts-based not-for-profit health system that operates hospitals in New England and Pennsylvania.

Covenant has confirmed that the following hospitals were impacted by the data breach: St. Joseph Hospital of Nashua, St. Joseph Healthcare in Bangor, Maine, and St. Mary’s Health System in Lewiston, Maine.

On May 26, 2025, Covenant discovered unusual activity in its information technology (IT) environment and learned that an unauthorized actor gained access to the environment—which contained patient information—on May 18, 2025. Although the breach occurred in May 2025, Covenant did not begin notifying under 8,000 affected individuals until on or around July 11, 2025, and then over 400,000 more individuals until on or around December 31, 2025. 

These delayed disclosures may have violated state and federal laws. The following information may have been compromised in the breach: names, addresses, dates of birth, medical record numbers, Social Security numbers, health insurance information and/or treatment information, such as diagnoses, dates of treatment, and types of treatment.

If your personal information was impacted by this incident, you may be at risk of identity theft and other serious violations of your privacy. As a result, you may be entitled to money damages and an injunction requiring changes to Covenant’s cybersecurity practices.

If you received notification of this data breach or are a patient of Covenant Health and/or one of the hospitals listed above, and wish to obtain additional information about your legal rights, please fill out the form below.