Covenant Health has reached a $2 million settlement in a class action lawsuit filed after a May 2025 data breach compromised sensitive patient information. More than 280,000 patients in Maine were impacted. Covenant Health owns St. Joseph Healthcare in Bangor and St. Mary’s in Lewiston.
Plaintiff Michael McClain filed the complaint on behalf of himself and others whose personal and medical information was allegedly exposed during the breach. The lawsuit accused Covenant Health of failing to properly protect patients’ private information.
It claimed the breach was preventable and resulted from the defendants’ failure to implement standard cybersecurity practices. It also alleged that affected individuals now face an increased risk of identity theft and fraud.
In the settlement agreement, Covenant Health denies any wrongdoing. A spokesperson told Maine’s Total Coverage, “We have agreed to the settlement so that our resources and attention are focused on what matters most in our ministry: the patients and residents who entrust us with their care and the communities we have the privilege of serving.”
The impacted Maine patients may submit proof of documented losses related to the Data Incident for cash payments up to $5,000, or they can receive a $75 cash payment without documentation. That amount may vary based on the number of valid claims.
In addition to the cash payment, they will be automatically enrolled in a program for credit monitoring, dark web monitoring, real-time authentication alerts, high-risk transaction monitoring, lost wallet protection, and insurance coverage for up to $1,000,000 for identity theft.
Before the payout begins, the settlement must first be approved by a judge.
