Covenant Health, a Catholic health system with facilities in Maine, New Hampshire and Pennsylvania, detected unusual activity in its IT environment on 26 May 2025 and discontinued access to data systems across its hospitals, clinics and provider practices while it investigated.
The precautionary shutdown disrupted care across New England. St. Joseph Hospital in Nashua, New Hampshire, St. Joseph Healthcare in Bangor, Maine, and St. Mary's Health System in Lewiston, Maine all reported problems, including phone and internet outages and longer waits. Laboratory work was restricted, with the Nashua hospital limiting lab services to its main campus and accepting only physical orders. Post acute care sites, which ran on a different clinical platform, saw minimal impact. Covenant Health told patients to keep their scheduled appointments.
The organisation brought in outside cybersecurity experts and worked to restore systems. As of 30 May no group had claimed responsibility and the health system had not said whether patient information was involved.
Both questions were answered later. Covenant Health determined that an unauthorised actor had been inside its environment since 18 May, and the Qilin ransomware group claimed the intrusion. Notifications went to 7,864 people in July 2025 and were revised sharply upward at the end of December, when the total reached 478,188. Exposed data included names together with addresses, dates of birth, medical record numbers, Social Security numbers, health insurance information, diagnoses and treatment details.
Updates
Covenant Health revised the number of affected people to 478,188, up from the 7,864 it notified in July 2025, and began mailing a second round of notification letters. Its investigation concluded on 10 December 2025.
Covenant Health revised the number of affected people to 478,188, up from the 7,864 reported in July 2025. Qilin claimed responsibility for the attack.