Central Maine Healthcare Settles $1.3M Lawsuit Over 2025 Data Breach Affecting 450,000 Patients
Central Maine Healthcare has agreed to a $1.3 million settlement following a 2025 cyberattack that exposed the personal and medical data of over 450,000 patients. The breach, which targeted the healthcare system’s IT network, occurred between March and June 2025, allowing an unauthorized party to access sensitive information, including names, birth dates, Social Security numbers, and treatment records.
The settlement, finalized on July 1, resolves six consolidated class action lawsuits filed on behalf of affected individuals. While Central Maine Healthcare denies liability, the agreement establishes a cash fund for impacted patients. Those who can document losses may claim up to $5,000, while others may receive $50 without documentation. Additionally, affected individuals are eligible for one year of free medical records monitoring. Claims must be submitted by September 28, with final court approval expected at an October 28 hearing in Androscoggin County Superior Court.
The breach affected patients across Central Maine Healthcare’s facilities, including Central Maine Medical Center in Lewiston, Bridgton Hospital, and Rumford Hospital. Separately, Covenant Health, another Maine-based healthcare provider, faced multiple lawsuits in 2025 after a May cyber incident compromised data for nearly 478,000 patients, including 285,000 Maine residents.
Covenant HealthCare cybersecurity rating report: https://www.rankiteo.com/company/covenant-healthcare
"id": "COV1787430685",
"linkid": "covenant-healthcare",
"type": "Breach",
"date": "8/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '450,000',
'industry': 'Healthcare',
'location': 'Maine, USA',
'name': 'Central Maine Healthcare',
'type': 'Healthcare Provider'},
{'industry': 'Healthcare',
'location': 'Lewiston, Maine, USA',
'name': 'Central Maine Medical Center',
'type': 'Hospital'},
{'industry': 'Healthcare',
'location': 'Bridgton, Maine, USA',
'name': 'Bridgton Hospital',
'type': 'Hospital'},
{'industry': 'Healthcare',
'location': 'Rumford, Maine, USA',
'name': 'Rumford Hospital',
'type': 'Hospital'}],
'attack_vector': 'Unauthorized network access',
'customer_advisories': 'Claims process for affected individuals with '
'deadlines and compensation details',
'data_breach': {'number_of_records_exposed': '450,000',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Birth dates',
'Social Security numbers',
'Treatment records']},
'date_detected': '2025-06-01',
'date_resolved': '2025-07-01',
'description': 'Central Maine Healthcare has agreed to a $1.3 million '
'settlement following a 2025 cyberattack that exposed the '
'personal and medical data of over 450,000 patients. The '
'breach allowed an unauthorized party to access sensitive '
'information, including names, birth dates, Social Security '
'numbers, and treatment records.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal and medical data',
'financial_loss': '$1,300,000',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuits',
'systems_affected': 'IT network'},
'investigation_status': 'Settled',
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuits'},
'response': {'communication_strategy': 'Settlement announcement and claims '
'process',
'enhanced_monitoring': 'One year of free medical records '
'monitoring for affected individuals'},
'title': 'Central Maine Healthcare Data Breach Settlement',
'type': 'Data Breach'}