A May 2025 cyberattack on the Catholic health system exposed Social Security numbers and medical details for more than half a million people.

 

What happened

Covenant Health, Inc.; St. Joseph Healthcare Foundation; St. Joseph Hospital in Bangor, Maine; and St. Joseph Hospital Nashua, N.H., have agreed to pay $2 million to resolve class action litigation over a 2025 cyberattack, according to the settlement agreement filed in the Penobscot County Superior Court in Maine. The court granted preliminary approval on September 15, 2026, and the agreement puts the settlement class at approximately 502,606 people.

 

Going deeper

Covenant Health, a Catholic health system based in Andover, Massachusetts, runs hospitals, nursing and rehabilitation centers, and elder care services across New England and parts of Pennsylvania. It spotted unusual activity in its IT environment on May 26, 2025, and forensic investigators later traced the first unauthorized access to May 18. The compromised systems held names, addresses, dates of birth, medical record numbers, Social Security numbers, health information, and insurance details.

The scale of the breach grew over time. Covenant Health's first report in July 2025 listed 7,864 affected individuals, a figure BleepingComputer reported rose to 478,188 once most of the data analysis was complete, with a second round of letters mailed on December 31, 2025. The Qilin ransomware group claimed the attack in late June 2025, alleging it took 852 GB of data across nearly 1.35 million files. Paubox has profiled Qilin and its pattern of attacks on healthcare providers. Several lawsuits followed and were consolidated as In re: Covenant Health Data Security Litigation (No. PENSC-CV-2025-63). Plaintiffs argued the breach was preventable and brought claims for negligence, breach of implied contract, unjust enrichment, and declaratory judgment. The parties reached agreement on most material terms at an April 23, 2026, mediation and finalized the remaining details in later negotiations.

 

What was said

The defendants deny every claim in the lawsuit and settled without admitting fault. In the settlement agreement, they said they agreed to resolve the case to avoid the "distractions, burden, expense, and disruption to its business operations" of further litigation.

 

The big picture

The Covenant Health case fits a long-running pattern in healthcare. A cohort study in JAMA Health Forum identified 374 ransomware attacks on US healthcare delivery organizations between 2016 and 2021, exposing the PHI of nearly 42 million patients, while the annual count more than doubled from 43 to 91. The researchers also found these attacks increasingly hit large organizations with multiple facilities, the same profile as a regional system like Covenant Health.

Covenant Health has not publicly said how the attackers got in. Email remains a frequent entry point across the sector, though. Paubox's 2026 Healthcare Email Security Report counted 170 email-related healthcare breaches in 2025 and found 74% of breached domains had ineffective DMARC protection, up from 65% a year earlier. For multi-site systems, the cost of an intrusion now runs well past incident response and into years of notification, litigation, and settlement obligations.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

How long does a HIPAA covered entity have to notify patients of a breach?

The HIPAA Breach Notification Rule requires notice without unreasonable delay and no later than 60 calendar days after the breach is discovered.

 

Why do breach counts often grow months after an attack?

Identifying every affected person means reviewing large volumes of accessed or stolen files, so early notices often cover only the records confirmed first.

 

What is a pro rata payment in a data breach settlement?

It is a share of the remaining fund split among valid claimants, so the final amount rises or falls with the number of claims filed.