Notice of Data Security Incident
July 11, 2025
Covenant Health, Inc. (“Covenant Health”) and its affiliated entities* are committed to protecting our patients’ information. This notice is to inform you of a data security incident involving some of our patients’ information. This notice explains the incident, measures we have taken, and some steps you can take in response.
What Happened
On May 26, 2025, Covenant Health was alerted to unusual activity in our Information Technology (“IT”) environment. We immediately worked to secure and restore our systems and engaged industry-leading third-party information technology and forensic specialists to conduct a thorough investigation into the source and extent of the incident, including the amount and type of data that may have been affected. Through that investigation, we learned that an unauthorized party gained access to our IT environment on May 18, 2025, and was able to access some patient information.
What Information Was Involved
The investigation determined that information potentially involved varied by patient but may have included patient names and one or more of the following:
- Addresses
- Dates of birth
- Medical record numbers
- Social Security numbers
- Treatment information such as diagnoses, dates of treatment and type of treatment
- Health insurance information
What We Are Doing
On July 11, 2025, Covenant Health began mailing notification letters to individuals whose information may have been involved in the incident. For individuals whose Social Security numbers may have been involved, complimentary credit monitoring and identity theft protection services are being offered. Covenant Health continues its detailed review of the involved information and will mail letters to patients if more are identified.
As part of our ongoing commitment to the privacy of personal information in our care, we have also enhanced the security of our IT environment to help prevent something like this from happening again.
What Individuals Can Do
At this time, we are not aware of any fraudulent misuse of personal information related to this event.
Individuals whose information may have been involved in the incident should review the statements they receive from their health insurance plans. If they see any services that were not received, they should contact their health plan immediately.
Individuals with questions relating to this event are welcome to call our dedicated toll-free assistance line at 1-855-361-0344, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, excluding major U.S. holidays.
*St. Joseph Hospital of Nashua, N.H. (Nashua), St. Joseph Healthcare (Bangor), and St. Mary’s Health System (Lewiston).