Covenant Health: Data breach impacting owner of Maine hospital larger than previously thought

Cybersecurity Breach at Covenant Health Impacts Over 280,000 Mainers

Covenant Health, the owner of St. Mary’s Hospital in Lewiston, Maine, has disclosed a significant expansion of a previously reported data breach. Initially believed to have affected approximately 4,600 Mainers when first reported in July, the incident has now been confirmed to impact over 280,000 individuals—a more than sixtyfold increase in the estimated scope.

The amended breach notification, filed with the Maine Attorney General’s Office, follows further investigation into the incident. Covenant Health is offering credit monitoring and identity theft protection to those affected. The breach’s full extent and the nature of the exposed data remain under review, though the scale suggests a substantial compromise of sensitive information.

The disclosure comes amid unrelated regional incidents, including a New Year’s morning fire in Manchester that left one dead and eight hospitalized, as well as a privacy lawsuit filed by a former Naked and Afraid contestant against Kennebec County, alleging misconduct by officials. Meanwhile, Ashley Furniture announced plans to open a 44,900-square-foot store in South Portland by early 2026, creating 45 new jobs.

Source: https://wgan.com/news/074470-data-breach-impacting-owner-of-maine-hospital-larger-than-previously-thought/

Covenant Health (MA) cybersecurity rating report: https://www.rankiteo.com/company/covhealth

"id": "COV1767368230",
"linkid": "covhealth",
"type": "Breach",
"date": "7/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '280,000+ Mainers',
                        'industry': 'Healthcare',
                        'location': 'Maine, USA',
                        'name': 'Covenant Health',
                        'type': 'Healthcare Organization'}],
 'customer_advisories': 'Credit monitoring and identity theft protection '
                        'offered',
 'data_breach': {'number_of_records_exposed': '280,000+',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Personally identifiable '
                                             'information, sensitive data'},
 'description': 'Covenant Health, owner of St. Mary’s Hospital in Lewiston, '
                'filed an amended data breach with the Maine Attorney '
                'General’s Office. The breach, initially reported in July with '
                'an estimated 4,600 Mainers affected, was later found to '
                'impact over 280,000 Mainers. The company is offering credit '
                'monitoring and identity theft protection for those affected.',
 'impact': {'brand_reputation_impact': 'Likely negative',
            'data_compromised': 'Personal and sensitive information',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Potential'},
 'references': [{'source': 'Maine Attorney General’s Office'},
                {'source': '560 WGAN Newsradio'}],
 'regulatory_compliance': {'regulations_violated': 'Potential HIPAA violations',
                           'regulatory_notifications': 'Maine Attorney '
                                                       'General’s Office'},
 'response': {'communication_strategy': 'Public disclosure via Maine Attorney '
                                        'General’s Office',
              'remediation_measures': 'Credit monitoring and identity theft '
                                      'protection offered'},
 'title': 'Covenant Health Data Breach',
 'type': 'Data Breach'}