$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit
Covenant Health, St. Joseph Healthcare Foundation, St. Joseph Hospital, St. Joseph Hospital Nashua, N.H., and other Covenant Health facilities were named as defendants in multiple class action lawsuits stemming from a 2025 cybersecurity incident. A $2 million settlement has been agreed to resolve the litigation.
Suspicious activity was identified within Covenant Health’s computer systems on May 26, 2025. The forensic investigation determined that its network was first accessed by an unauthorized third party on May 18, 2025. The compromised parts of the network contained the protected health information of 502,606 individuals, including their names, addresses, dates of birth, medical record numbers, Social Security numbers, health information, and health insurance information. Notification letters started to be mailed to the affected individuals on July 11, 2025.
Multiple class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – In re: Covenant Health Data Security Litigation – in the Penobscot County Superior Court in Maine. The consolidated lawsuit alleged that the defendants were at fault and that the incident and data breach should have been prevented. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, and declaratory judgment. The defendants maintain that there was no wrongdoing and disagree with the claims and contentions in the lawsuit.
The parties attended mediation on April 23, 2026, and agreed to most of the material terms of a settlement. During ongoing negotiations, a settlement was negotiated that was acceptable to all parties. The settlement has now received preliminary approval from the court. Under the terms of the settlement, the defendants have agreed to establish a $2,000,000 settlement fund, which will be used to pay for class member benefits after attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives have been deducted.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members may submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. Class members may also claim a pro rata cash payment, estimated to be approximately $75 per class member. In addition to the cash payments, class members are entitled to claim a two-year membership of the CyEx Medical Shield Complete credit monitoring service. The defendants have also agreed to implement security enhancements to reduce the risk of similar incidents in the future. The deadline for objection and opting out is December 15, 2026. The deadline for submitting a claim is December 30, 2026. The final fairness hearing has will be in early 2027; however, a date has yet to be set.
