Central Maine Healthcare First Reported Its Breach as Affecting 8 People, Then 145,381 — Now $1.37 Million Is on the Table for 218,884 Letter Recipients, the Opt-Out Deadline Falls on a Sunday, and Claims Close September 28

The breach at Central Maine Healthcare — the Lewiston-based system that runs Central Maine Medical Center — was first reported to the Maine Attorney General as affecting eight people. In January 2026 a new filing put the number at 145,381, including 138,800 Mainers, as WGME reported on January 14. The settlement agreement now describes a third number: CMH “mailed written notification letters to approximately 218,884 individuals whose information may have been impacted by the Data Incident,” and defines the class list as “the list of approximately 218,884 Settlement Class Members.”

The three figures are not contradictions so much as three different questions — how many were confirmed affected, how many were told, and how many are now in the class. The one that matters for a claim is the last: the class is everyone who got a letter. The settlement site describes the incident only as “the potential unauthorized access to Settlement Class Members' Private Information from approximately March to June of 2025,” and the private information as “names combined with any other type of private health information or non-public personally identifiable information.”

Six class actions were filed over the breach and consolidated into one case; the Sun Journal reported on August 20 that the parties reached the deal on July 1 “after months of mediation.” The preliminary approval order was signed on July 9, 2026, and notice went out by mail on August 10. The defendants deny wrongdoing and the court has decided nothing on the merits.

The class definition, from the preliminary approval order: “All individuals residing in the United States whose Private Information may have been impacted in the Data Incident and to whom Defendants sent an individual notification that they were affected by the Data Incident.” The second clause is the gate. If CMH did not mail you, you are not in this class, whatever your relationship to the hospital.

That is worth stating because the other large healthcare breach settlement open this week, ConnectOnCall's, works the other way — anyone whose data “may have been impacted” is in, letter or not. Two Epiq-administered settlements, two opposite eligibility rules. Read the one you are actually filing under.

Excluded are the defendants' directors and officers, governmental entities, and the judge, the judge's immediate family and court staff.

Cash Payment A — Documented Losses: “reasonable documentation for losses traceable to the Data Incident for up to $5,000 per Settlement Class Member.” Nothing already reimbursed from another source. If the documentation does not hold up and you do not cure it, the claim “will be processed as if you elected Cash Payment B.”

Cash Payment B — Alternate Cash: “a pro rata (a legal term meaning equal share) cash payment in the estimated amount of $50.” No documentation. And, unusually, the site spells out that the number can move in either direction: “Your Cash Payment may be subject to pro rata increase if the amount of Valid Claims does not use the entire Settlement Fund … Alternatively, if the amount of Valid Claims exceeds the amount of the Net Settlement Fund … your Cash Payment may be subject to a pro rata reduction.” Most breach settlements only mention the downside. Because the fund is non-reversionary, a low claim rate here lifts the check rather than sending money back to the hospital.

Medical Records Monitoring: one year, on top of either cash payment. The settlement agreement names the product — CyEx's Medical Shield Complete “or its equivalent,” with “up to $1 million dollars of identity theft insurance coverage” — and says it is available “regardless of whether they previously received a credit monitoring product related to the Data Incident.” The administrator pays for monitoring first and cash second: “distribute the funds in the Net Settlement Fund first for payment of Medical Records Monitoring and then for Cash Payments.”

The fund is $1,368,025. The order calls it non-reversionary and says it pays “all Settlement Class Member Benefits; Settlement Administration Costs; any Court-approved attorneys' fees and costs to Class Counsel; and any Court-approved Service Awards.” Class counsel — Mariya Weekes of Milberg and Jeff Ostrow of Kopelowitz Ostrow — “will file a motion asking the Court to award attorneys' fees of up to one-third of the Settlement Fund, plus reimbursement of reasonable costs,” which is $456,008 at the cap, plus service awards of up to $2,500 per class representative. The administration cost is not stated on the site.

Set the fee at its cap and about $912,000 is left before administration, costs and monitoring. Divide that by $50 and it covers roughly 18,000 no-proof claims — about eight percent of the 218,884-name list — before monitoring and administration are even subtracted. If fewer people file, the check grows; if more do, it shrinks. That is the whole meaning of “estimated amount of $50,” and it is why the site uses the word estimated three times.

For comparison, the American Consumer Credit Counseling settlement we covered yesterday pays a fixed $45 because it is claims-made with no fund; the YES Communities settlement pays a fixed $50 for the same reason. Central Maine's $50 is the only one of the three that is genuinely a forecast.

Sunday, September 13, 2026 is the postmark deadline to opt out and the deadline to object. A Sunday postmark deadline is a trap, and the site's own advice applies with extra force: “mail may not be postmarked the day it is deposited in a mailbox or at a local post office. Postmarks occur when mail reaches a processing facility. To meet a postmark deadline, mail at least a week prior to a postmark deadline, get a manual postmark in-person at any post office, or send via Certified Mail.” Practically, that means Friday, September 11 at a counter, or earlier. Opt-outs go to the administrator at P.O. Box 2417, Portland, OR 97208-2417, personally signed; no email, no phone, no group opt-outs. Objections are filed with the Clerk, Androscoggin County Superior Court, 2 Turner Street, Auburn, ME 04210, and copied to class counsel, defense counsel (Baker & Hostetler) and the administrator.

Monday, September 28, 2026 is the claim deadline — online, or postmarked. From today that is 29 days. The opt-out deadline is 14.

Wednesday, October 28, 2026 at 9:00 a.m. is the final approval hearing, before Justice Thomas R. McKeon of Maine's Business and Consumer Court, sitting at the Androscoggin County Superior Court in Auburn. The docket number appears two ways in the record — the settlement site carries ANDSC-CIV-2025-00083, the Androscoggin Superior Court number, while the preliminary approval order is captioned BCD-CIV-2025-00028, the Business and Consumer Docket number; they are the same consolidated case. Payment comes only after approval becomes final: “It may take time for the Settlement to be approved and become final. Please be patient and check this website for updates.”