Covenant Health Systems hit by cyberattack, exposes patient data
Learn More
Covenant Health, a healthcare organization in New England, reports that multiple hospital facilities were targeted by cyberattack that resulted in unauthorized access to sensitive patient information across their network.
Covenant Health became aware of irregularities impacting connectivity across the organization on Monday, May 2. The healthcare organization shut down all data systems on their entire network, affecting hospitals, clinics, and provider practices, including:
- St. Joseph Hospital
- Bangor Nursing and Rehabilitation Center,
- St. Mary's Health System and St. Mary's d'Youville Pavilion in Lewiston,
- St. Andre Health Care in Biddeford
- St. Joseph Hospital in Nashua, New Hampshire
The organization had to resort to emergency protocols to maintain patient care. Patients needing certain scans have been taken to other facilities, and some patients reported having trouble filling prescriptions. The attack exposed patient data, inlcuding:
- Patient names and addresses
- Dates of birth
- Medical record numbers
- Social Security numbers
- Treatment information including diagnoses and dates of treatment
- Health insurance information
- Types of medical treatments received
Covenant Health has not disclosed the number of affected patients and the nature of the attack.
Update - as of 3rd of January 2026, Covenant Health reports that after completing “the bulk of its data analysis” 478,188 individuals are affected by the breach. The healthcare entity initially reported in July that the data of 7,864 people had been exposed.
The Qilin ransomware group claimed the attack, claiming they stole 852 GB of data comprising nearly 1.35 million files.
The company is offering credit monitoring and identity theft protection to any patients who may have been affected. The organization has established a toll-free assistance line at 1-855-361-0344, operating Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, to address patient concerns and provide support services.
