Covenant Health Data Breach Lawsuit: 478,188 People, No Settlement Announced
Active Litigation
Covenant Health is the Catholic health system behind St. Joseph Hospital in Bangor, St. Mary’s in Lewiston and St. Joseph Hospital in Nashua. An intruder was inside its network from May 18 to about May 26, 2025. The headcount grew from about 7,800 to 478,188 when the December 31, 2025 letters went out. The federal lawsuits are now one case in Boston. In March 2026 the parties agreed to pause it for mediation. As of October 15, 2026, no settlement, fund or claim form has been announced.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Covenant Health Data Breach
Covenant Health, Inc. is based in Andover, Massachusetts. It runs care sites in Massachusetts, Maine, New Hampshire, Pennsylvania, Rhode Island and Vermont. According to its notice, an unauthorized party entered its IT environment on May 18, 2025. Covenant detected the activity on May 26, 2025 and disconnected its hospitals’ data systems. St. Mary’s in Lewiston could only process paper lab orders, and St. Joseph Hospital in Nashua offered lab services only with a physical order in hand.
The investigation finished on December 10, 2025. Covenant had told Maine’s attorney general in July that about 7,800 people were affected. Its updated filing of December 31, 2025 put the total at 478,188, of whom 284,529 live in Maine. The exposed fields: name, address, date of birth, Social Security number, medical record number, health insurance information and treatment information such as diagnoses and dates of treatment. A ransomware gang claimed the attack in June 2025 and says it published the stolen files; that is the gang’s claim, not a court finding.
The lawsuits allege that Covenant failed to use reasonable safeguards, train staff, limit data retention or encrypt patient data. Covenant has not admitted those allegations.
Case details
Federal case (the main one). In re Covenant Health Data Breach Litigation, No. 1:26-cv-10032, U.S. District Court for the District of Massachusetts, before Judge William G. Young. The lead case was filed on January 5, 2026. Related suits filed that month, including Wickett v. Covenant Health, Inc. (1:26-cv-10044), Cole (1:26-cv-10128), Phillips (1:26-cv-10131), Hall (1:26-cv-10146), Walder (1:26-cv-10155), Chuba (1:26-cv-10171) and DeFlaminis (1:26-cv-10229), are now handled in the lead case. A consolidated complaint was filed on February 17, 2026 against Covenant Health, Inc., St. Joseph Hospital, St. Joseph Hospital Nashua and St. Joseph Healthcare Foundation. You can follow the public docket on CourtListener.
Maine state case. In June 2025 a Bangor patient filed a proposed class action in Penobscot County Superior Court against St. Joseph Hospital and Covenant Health. We could not confirm how that case stands now.
Status: No Settlement Announced
The docket then shows a stipulation on April 28, 2026 and a status report on June 4, 2026. Neither is publicly readable. We found no settlement website, administrator or preliminary-approval order. Until one appears, there is no fund, no claim form and no deadline.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is in the Proposed Class
According to the complaint, the class would cover all U.S. residents whose information was compromised in the breach. That includes everyone who received a written breach notice from Covenant. You do not sign up for a class action. If a settlement is approved, a court-appointed administrator notifies class members directly.
Your proof is the letter. Covenant began mailing notices on December 31, 2025. A letter dated then or later that names Covenant Health, St. Joseph, St. Mary’s or St. Andre is the best evidence that you are affected. Keep it.
Is There Money Yet?
How cases like this one end
Our copy of the federal courts’ own case database covers 16,001 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2026, 11.3% of them filed as class actions:
- 32.5% ended in a settlement recorded by the court. Another 19.5% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 32.5% and 52.1%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.5 months.
- Median time from filing to the end of the case: 8.4 months.
- Only 250 of them (1.6%) record a money award at all; the median of those is $443,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Covenant Health Data Breach Timeline
May 18–26, 2025 — Intrusion and Shutdown
An unauthorized party gets into Covenant’s systems on May 18. Covenant detects it on May 26 and disconnects its hospitals’ data systems.
June 2025 — First Lawsuit and Ransom Claim
A Bangor patient sues in Penobscot County Superior Court. A ransomware gang claims the attack.
December 31, 2025 — 478,188 People, Letters Mailed
Covenant’s updated Maine filing raises the count from about 7,800 to 478,188, including 284,529 Maine residents. Notice letters go out.
January–February 2026 — Federal Suits Combined
Suits filed in Massachusetts federal court from January 5 are combined in No. 1:26-cv-10032. A consolidated complaint is filed on February 17.
March 2–3, 2026 — Stay for Mediation
The parties agree to pause for mediation. Judge Young closes the case until April 28, 2026 so the parties can report whether they settled.
As of October 15, 2026 — No Settlement Announced
A status report was filed on June 4, 2026. It is not public. No settlement website, claim form or deadline exists.
Three Things to Watch For
Almost half a million notice letters, a mediation and no settlement page: scammers fill gaps like that.
“Claim your Covenant Health settlement” sites
No settlement has been announced, so there is no claim portal. A page asking for your Social Security number or medical record number to “reserve your payment” is collecting data.
Callers naming St. Joseph or St. Mary’s
The hospital names are public, so a caller using them proves nothing. Covenant’s notice gave a toll-free call center you can reach yourself. A real administrator will never ask for a fee or your full Social Security number by phone.
Fake medical bills and insurance notices
The stolen data included insurance details and treatment information, which makes fake bills look real. Check any bill against your insurer’s explanation of benefits before you pay.
Covenant Health Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
What healthcare company got hacked?
Covenant Health, Inc. of Andover, Massachusetts. It owns St. Joseph Hospital in Bangor, St. Mary’s Health System in Lewiston, St. Andre Health Care in Biddeford and St. Joseph Hospital in Nashua, New Hampshire. Several unrelated organizations use similar names, including Covenant Surgical Partners and Covenant Care California. Their breaches are separate.
How many people were affected by the Covenant Health data breach?
478,188, according to Covenant’s updated December 31, 2025 filing with the Maine attorney general. 284,529 of them live in Maine. The July 2025 filing had reported about 7,800.
Is there a Covenant Health data breach lawsuit?
Yes. The main case is In re Covenant Health Data Breach Litigation, No. 1:26-cv-10032, in federal court in Massachusetts before Judge William G. Young. It combines suits filed from January 5, 2026 onward. A separate proposed class action was filed in June 2025 in Penobscot County Superior Court in Maine.
Is there a settlement or a claim form?
Not as of October 15, 2026. The federal case was paused for mediation in March 2026, and a status report followed on June 4, 2026. No settlement, administrator or claim deadline has been announced. If that changes, the administrator will mail or email class members.
How do I know if I was a part of a data breach?
For this breach, look for the notice letter Covenant began mailing on December 31, 2025. It lists the types of information involved for you and gives a toll-free number. For other breaches, check notice letters and the breach lists published by state attorneys general.
Is Covenant Health a faith-based organization?
Yes. Covenant Health calls itself a Catholic health care system and says its Catholic identity is its foundation. It is a nonprofit.
Is there a class action lawsuit related to the Change Healthcare breach?
That is a different breach at a different company. Being affected by Change Healthcare does not put you in the Covenant Health case. See our Change Healthcare data breach lawsuit page for that case.
What should I do right now?
Keep your notice letter. Freeze your credit at all three bureaus; it is free and you can undo it. Read your insurer’s explanation-of-benefits statements for care you never received. Massachusetts residents whose Social Security number was involved were offered free credit monitoring, so check your letter for an enrollment code.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable healthcare breach settlements have paid per person
- Change Healthcare Data Breach LawsuitA separate healthcare breach case with its own lawsuits
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorEstimate a per-person share once a fund and class size are known