Andover, Massachusetts-based Covenant Health, Inc. has informed authorities that a data breach discovered in May 2025 impacts more than 478,000 individuals.
Covenant Health offers healthcare services at over a dozen locations across Massachusetts, Maine, New Hampshire, Pennsylvania, Rhode Island, and Vermont.
The organization is informing customers that their personal and health information may have been compromised as a result of a hacker attack that occurred on May 18, 2025.
The intrusion was discovered on May 26, and it took until December for Covenant Health to complete its investigation.
Covenant Health first disclosed the data breach to the Maine Attorney General’s Office in July, when it reported that only 7,800 individuals had been impacted.
In an updated notification to the Maine AGO on December 31, the healthcare organization revealed that the number of affected individuals is actually 478,188.
It’s not uncommon for healthcare data breaches to impact hundreds of thousands and even millions of individuals.
Covenant Health said the hackers obtained information such as name, date of birth, address, SSN, medical record number, health insurance information, and treatment information.
The Qilin ransomware group took credit for the attack on Covenant Health in June 2025, claiming to have stolen more than 1.3 million files with a total size of 850 GB.
Data allegedly stolen from the healthcare organization has since been made public by the cybercrime group, which indicates that a ransom has not been paid.
Related: 113,000 Impacted by Data Breach at Virginia Mental Health Authority
Related: 700,000 Records Compromised in Askul Ransomware Attack
Related: Tri-Century Eye Care Data Breach Impacts 200,000 Individuals
