Covenant Health data breach after ransomware attack impacted over 478,000 people

Covenant Health, a Massachusetts-based healthcare provider, suffered a ransomware attack in May 2025 that disrupted systems across its hospitals, clinics and practices, including St. Joseph’s in New Hampshire and two Maine hospitals. The incident, which began around May 18, 2025, led the organisation to notify that data of more than 478,000 individuals may have been compromised, with the total later updated to 478,188 in December 2025.

Compromised information reportedly includes patient name, date of birth, address, SSN, medical record number, health insurance information and/or treatment information such as diagnoses and dates of treatment. In June, the Qilin ransomware group claimed responsibility for the attack and announced the theft of 850 GB of sensitive data.

According to the data breach notification sent to the Maine Attorney General’s Office, Covenant Health mailed letters to patients by 31 December 2025 and offered complimentary credit monitoring and identity protection services to Massachusetts residents whose Social Security numbers may have been involved. Covenant Health has also established a toll-free call centre and enhanced IT security to help prevent a recurrence.