HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCriticalContained
COVENANT HEALTH
bd_072a28e8c90a0e6b · schema v1 · pii pii-v1
Full breach record for COVENANT HEALTH →Covenant Health, Inc. reported an external system breach (hacking) occurring on May 18, 2025, discovered on May 26, 2025. The incident affected 478,188 individuals, including 284,529 Maine residents. Affected data included names and personal identifiers combined with government-issued identifiers. Covenant Health sent written notifications starting July 11, 2025, and provided 12 months of identity monitoring and restoration services through Experian.
Maine clockDiscovered May 26, 2025 → Filed with AG Dec 31, 2025219d ✗ ME AG >90d31 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_0201f6c42742ffa2New Hampshire State AGfiled 2025-12-31Verified
- bd_ef41caaf4af9cbfeVermont State AGfiled 2025-12-31Verified
- bd_9f5aba5bf6f7a978California State AGfiled 2026-01-02(2d gap)Candidate
- bd_e35a31c1ca87c68cMontana State AGfiled 2026-01-02(2d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 5d gap
- bd_95ce0e0243eda112Texas State AGfiled 2026-01-05(5d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2637476a-ce93-46b9-a8c9-e2705955dc98.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 31, 2025
- Raw hash
- 8e5f860928f39ca6ada1f5580f7281e299fd796db26bf9c474c3214d0d1c5fad
Reporting entity
- Name
- COVENANT HEALTHnorm: covenant health
Victim entity
- Name
- COVENANT HEALTHnorm: covenant health
Incident
- Discovered
- May 26, 2025
- Materiality determined
- —
- Notification sent
- Jul 11, 2025
- Affected individuals
- 478,188
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 31 weeks(219 days from discovery to filing)
- Compliance flags
- ME AG >90d · 219d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 26, 2025→ Filed with AG: Dec 31, 2025219d 90 days ME AG >90d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.