Owner of Lewiston, Bangor hospitals agrees to $2M settlement over data breach
St. Mary's Regional Medical Center in Lewiston is pictured in December 2023. (Russ Dillingham/Staff Photographer)
Covenant Health, which owns hospitals in Lewiston and Bangor, has agreed to pay $2 million to settle a class action lawsuit over a data breach that impacted at least 284,000 Maine residents last year.
The breach hit patients at St. Joseph Healthcare in Bangor, St. Mary’s Regional Medical Center in Lewiston and other Covenant Health facilities across New England. An unauthorized party gained access to the health system’s IT network in May 2025, compromising the private health information of more than 500,000 patients until it was discovered in July, according to the class action settlement agreement.
Related
Owner of Lewiston hospital vastly underestimated scope of May data breach
Compromised information may have included patients’ names, addresses, Social Security numbers, treatment details and health insurance information.
Claiming the health system did not protect their private information, nearly a dozen patients sued Covenant Health and joined a class action lawsuit that represents all patients impacted by the breach. Covenant Health agreed to pay $2 million to settle the lawsuit, without admitting any liability or wrongdoing.
Settlement class members can submit a claim to receive up to $5,000 in cash for documented losses, or get a cash payment of an estimated $75. All members will receive two years of complimentary credit monitoring services, according to the Covenant Health data settlement website. Mailed notices have gone out to members of the settlement class. Claims can be submitted online or mailed, so long as they are postmarked by Dec. 30.
A hearing will determine whether the court grants final approval to the settlement. It will take place at the Penobscot County Superior Court in 2027, according to the order.
Related
Lewiston’s Central Maine Healthcare agrees to $1.3M settlement over data breach
There was a final hearing Wednesday regarding a similar settlement agreement between patients and Central Maine Healthcare. The health system, which owns Central Maine Medical Center in Lewiston as well as hospitals in Rumford and Bridgton, agreed to pay more than $1.3 million to resolve claims that it did not protect patient information during a 2025 data breach.
The Maine Business and Consumer Court did not immediately respond to an inquiry about the result of the hearing.
Copy the Story Link
Tagged: bangor maine, lewiston maine
Hannah Kaufman covers health and access to care in central and western Maine. She is on the first health reporting team at the Maine Trust for Local News, looking at state and federal changes through the. More by Hannah Kaufman
