COVENANT HEALTH
bd_0201f6c42742ffa2 · schema v1 · pii pii-v1
Full breach record for COVENANT HEALTH →Covenant Health, Inc. filed a supplemental notification with the New Hampshire Attorney General regarding a data security incident. An unauthorized party accessed the IT environment on May 18, 2025, after unusual activity was detected on May 26, 2025. The breach affected 154,188 New Hampshire residents, exposing names, addresses, DOBs, SSNs, medical record numbers, and treatment information. Covenant Health engaged forensic specialists, notified law enforcement, and offered one year of Experian IdentityWorks to affected individuals. Notifications were mailed on December 31, 2025.
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_072a28e8c90a0e6bMaine State AGfiled 2025-12-31Verified
- bd_ef41caaf4af9cbfeVermont State AGfiled 2025-12-31Verified
- bd_9f5aba5bf6f7a978California State AGfiled 2026-01-02(2d gap)Candidate
- bd_e35a31c1ca87c68cMontana State AGfiled 2026-01-02(2d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 5d gap
- bd_95ce0e0243eda112Texas State AGfiled 2026-01-05(5d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/covenant-health-20251231.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 31, 2025
- Raw hash
- fde5bb94c9f2548ec8dc8e1edf6a1674202a5328eab433b475956eeaeced3005
Reporting entity
- Name
- COVENANT HEALTHnorm: covenant health
Victim entity
- Name
- COVENANT HEALTHnorm: covenant health
Incident
- Discovered
- May 26, 2025
- Materiality determined
- —
- Notification sent
- Dec 31, 2025
- Affected individuals
- 154,188
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified federal law enforcement and appropriate agencies
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 31 weeks(219 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.