The Massachusetts-based parent company of St. Mary’s Health System in Lewiston and St. Joseph Healthcare in Bangor is now reporting that a data breach last May impacted more than 284,000 people in Maine.
The filing with the Maine Attorney General’s Office from Covenant Health is a major increase from its previous figures, showing only about 4,600 Mainers impacted.
The company says sensitive personal information potentially involved in the hack included names, Social Security numbers, and home addresses.
It says it sent letters last Wednesday to patients whose information may have been involved and is offering a free one-year membership to a program – Experian IdentityWorksSM – which helps detect possible misuse of personal information and provides identity protection support.
Covenant Health says that on December 10, 2025, the company and its third-party forensic specialists determined information may have been involved in a data security incident that occurred earlier this year.
The company also says it’s enhanced the security of its IT systems to help prevent something like this from happening again.
“We are committed to the safety of our patients and their personal information and sincerely regret any concern this incident may have caused you,” Covenant Health said in a statement.
