Covenant Health $2M Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. The deadline is December 30, 2026: 11:59 p.m. Eastern for online claims, or postmarked that day for mailed claims. Justice Bruce C. Mallonee of the Maine Superior Court in Penobscot County granted preliminary approval on September 15, 2026. The final approval hearing has not been scheduled yet, and no payment date has been set. Filing online requires the Class Member ID from the postcard notice.

What Changed Recently?

Covenant Health, Inc., St. Joseph Healthcare Foundation, St. Joseph Hospital in Bangor, Maine and St. Joseph Hospital in Nashua, New Hampshire agreed to pay $2 million to settle the class actions over a 2025 cyberattack. According to the settlement agreement, an unauthorized party got into Covenant Health's IT environment on May 18, 2025; the company noticed problems on or about May 26, 2025, shut down access to its data systems as a precaution, and began mailing notification letters on July 11, 2025. The case is In re Covenant Health Data Security Litigation, No. PENSC-CV-2025-63, in the Maine Superior Court for Penobscot County, and the settlement also resolves a parallel federal case in Massachusetts. Justice Bruce C. Mallonee granted preliminary approval on September 15, 2026. That same day he rescinded an order granting final approval that had been signed on September 1, which the parties said was submitted by mistake. Covenant Health denies the claims and any wrongdoing, and the court has not decided who is right.

Who Qualifies?

The settlement class is all living people in the U.S. whose private information was compromised in the cyberattack, including everyone who was sent a notice of the incident. The settlement agreement puts the class at about 502,606 people. Covenant Health operates hospitals, nursing and rehabilitation centers, physician practices and elder care services in Maine, Massachusetts, New Hampshire, Pennsylvania, Rhode Island and Vermont. According to the agreement, the information involved may have included names, addresses, dates of birth, medical record numbers, Social Security numbers, treatment information and health insurance information.

Excluded are Covenant Health's directors and officers, the judges assigned to the case and their families and staff, and anyone who opts out.

How Much Can You Get?

Class members can claim either or both cash payments, and everyone gets credit monitoring:

• Cash Payment B — pro rata cash, estimated at $75. No documentation is needed. It is a share of what is left of the $2 million fund after administration costs, court-approved service awards, attorneys' fees and costs, the cost of credit monitoring and documented-loss claims. It rises if fewer people claim and falls if more do.

• Cash Payment A — documented losses, up to $5,000. This covers unreimbursed losses from the incident, such as fraud or identity theft losses, credit monitoring bought on or after May 18, 2025, bank fees, postage, long-distance phone charges or gas for local travel, with third-party documentation such as receipts or statements. A loss claim that is rejected and not fixed is treated as a claim for the pro rata cash.

• Two years of credit monitoring. Every class member automatically receives an enrollment code on the postcard notice for CyEx Medical Shield Complete with one-bureau credit monitoring, dark web monitoring and up to $1 million in identity theft insurance. The code works after final approval; no claim is needed.

Class counsel will ask for attorneys' fees of up to one-third of the settlement value plus costs, and service awards of up to $2,500 for each class representative, all paid from the fund. Covenant Health has also agreed to security improvements paid for separately. None of the money goes back to the company; any residual goes to the Maine Bar Foundation.