Central Maine Healthcare underestimates data breach, confirms 145K affected

Central Maine Healthcare has completed notifying 145,381 individuals affected by a data breach that the organization initially reported as impacting only eight patients.

What happened

On June 1, 2025, Central Maine Healthcare detected unusual activity within its information technology network and immediately took steps to secure its systems. The organization launched an investigation with the assistance of third-party cybersecurity experts and notified law enforcement.

The investigation determined that an unauthorized party had gained access to Central Maine Healthcare's IT environment beginning March 19, 2025, maintaining access for approximately 74 days before the intrusion was discovered. During this period, the attackers may have accessed and acquired files containing protected health information (PHI) belonging to patients as well as current and former employees.

Central Maine Healthcare completed its investigation and analysis on November 6, 2025. Between July 31, 2025 and December 29, 2025, the organization notified affected patients, with the final notification wave concluding just before the new year.

The compromised data varies by individual but may include:

• Full names
• Dates of birth
• Treatment information
• Dates of service
• Provider names
• Health insurance information
• Social Security numbers (for some patients)

What's new

The most significant development is the dramatic expansion of the breach's confirmed scope. When Central Maine Healthcare initially reported the incident to the Office of the Maine Attorney General last summer, the filing indicated only eight individuals were affected.

The final count of 145,381 affected individuals represents an increase of more than 1.8 million percent from that initial disclosure. Central Maine Healthcare filed an updated notice with the Maine Attorney General on January 12, 2026, reflecting the completed investigation findings.

In response to the incident, Central Maine Healthcare stated it has implemented enhanced monitoring and alerting software to further protect and monitor its systems.

Go deeper: Central Healthcare Maine faces multiple lawsuits following data breach

The big picture

The discrepancy between initial and final breach counts reflects a pattern emerging among healthcare organizations in Maine and nationally. Covenant Health, the parent company of St. Mary's Health System in Lewiston and St. Joseph's in Bangor, followed a similar trajectory. The organization initially reported to the Maine Attorney General that a May 2025 cybersecurity incident had impacted approximately 8,000 people. Updated disclosures now confirm the breach affected 478,000 individuals.

These discrepancies usually occur because organizations must report breaches to state attorneys general within specific timeframes, often before forensic investigations can determine the full scope. As investigators analyze affected systems and review compromised files, the number of confirmed victims frequently grows substantially.

The 74-day dwell time in the Central Maine Healthcare breach, the period attackers maintained access before detection, exceeds industry benchmarks for healthcare organizations. According to IBM's 2025 Cost of a Data Breach Report, organizations with dwell times exceeding 200 days face higher breach costs, though even shorter intrusions like CMH's can result in substantial data exposure when attackers have persistent access to network systems.

Central Maine Healthcare serves approximately 400,000 people across central and western Maine through its network of hospitals, cancer care facilities, and primary and specialty care practices. The breach's impact ripples across a significant portion of that patient population.

What was said

"A lot of people have relied on passwords for many years, but that's really not enough now. Multi-factor authentication is quickly overtaking that," said Christopher Rhoda, Chief Information Officer at Thomas College, commenting on protective measures individuals should consider following breaches.

Rhoda recommended that affected individuals take advantage of fraud detection software, consider freezing their credit, and carefully monitor bank communications for signs that someone has opened accounts using their stolen information.

FAQs

What is dwell time in cybersecurity?

Dwell time refers to the period between when an attacker first gains access to a system and when the intrusion is detected. Longer dwell times tend to correlate with greater data exposure, as attackers have more opportunity to explore systems, escalate privileges, and exfiltrate information.

Why do breach counts change over time?

Initial breach disclosures often occur before forensic investigations are complete, as organizations must meet regulatory notification deadlines. As investigators analyze compromised systems and review affected files, they frequently identify additional victims.