People whose information was compromised in the May 2025 cyberattack on Covenant Health, including patients of St. Joseph Hospital in Bangor, Maine and St. Joseph Hospital in Nashua, New Hampshire, may qualify to claim an estimated $75 and up to $5,000 in documented losses from the $2 million Covenant Health data breach class action settlement. Claims are open through December 30, 2026.
Current Status
Claims are open. The deadline is December 30, 2026: 11:59 p.m. Eastern for online claims, or postmarked that day for mailed claims. Justice Bruce C. Mallonee of the Maine Superior Court in Penobscot County granted preliminary approval on September 15, 2026. The final approval hearing has not been scheduled yet, and no payment date has been set. Filing online requires the Class Member ID from the postcard notice.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
Covenant Health, Inc., St. Joseph Healthcare Foundation, St. Joseph Hospital in Bangor, Maine and St. Joseph Hospital in Nashua, New Hampshire agreed to pay $2 million to settle the class actions over a 2025 cyberattack. According to the settlement agreement, an unauthorized party got into Covenant Health's IT environment on May 18, 2025; the company noticed problems on or about May 26, 2025, shut down access to its data systems as a precaution, and began mailing notification letters on July 11, 2025. The case is In re Covenant Health Data Security Litigation, No. PENSC-CV-2025-63, in the Maine Superior Court for Penobscot County, and the settlement also resolves a parallel federal case in Massachusetts. Justice Bruce C. Mallonee granted preliminary approval on September 15, 2026. That same day he rescinded an order granting final approval that had been signed on September 1, which the parties said was submitted by mistake. Covenant Health denies the claims and any wrongdoing, and the court has not decided who is right.Who Qualifies?
The settlement class is all living people in the U.S. whose private information was compromised in the cyberattack, including everyone who was sent a notice of the incident. The settlement agreement puts the class at about 502,606 people. Covenant Health operates hospitals, nursing and rehabilitation centers, physician practices and elder care services in Maine, Massachusetts, New Hampshire, Pennsylvania, Rhode Island and Vermont. According to the agreement, the information involved may have included names, addresses, dates of birth, medical record numbers, Social Security numbers, treatment information and health insurance information.Excluded are Covenant Health's directors and officers, the judges assigned to the case and their families and staff, and anyone who opts out.
How Much Can You Get?
Class members can claim either or both cash payments, and everyone gets credit monitoring:• Cash Payment B — pro rata cash, estimated at $75. No documentation is needed. It is a share of what is left of the $2 million fund after administration costs, court-approved service awards, attorneys' fees and costs, the cost of credit monitoring and documented-loss claims. It rises if fewer people claim and falls if more do.
• Cash Payment A — documented losses, up to $5,000. This covers unreimbursed losses from the incident, such as fraud or identity theft losses, credit monitoring bought on or after May 18, 2025, bank fees, postage, long-distance phone charges or gas for local travel, with third-party documentation such as receipts or statements. A loss claim that is rejected and not fixed is treated as a claim for the pro rata cash.
• Two years of credit monitoring. Every class member automatically receives an enrollment code on the postcard notice for CyEx Medical Shield Complete with one-bureau credit monitoring, dark web monitoring and up to $1 million in identity theft insurance. The code works after final approval; no claim is needed.
Class counsel will ask for attorneys' fees of up to one-third of the settlement value plus costs, and service awards of up to $2,500 for each class representative, all paid from the fund. Covenant Health has also agreed to security improvements paid for separately. None of the money goes back to the company; any residual goes to the Maine Bar Foundation.
What Proof or Notice ID Is Required?
The online claim form starts with a login that asks for the Class Member ID printed on the postcard notice. The paper claim form, which can be printed from the settlement website and mailed, asks for the Class Member ID if known. The pro rata cash needs no receipts; documented-loss claims need third-party documentation and an attestation under penalty of perjury.What Is the Deadline?
Claims must be submitted online by 11:59 p.m. Eastern on December 30, 2026, or mailed and postmarked by December 30, 2026. Opt-out requests must be mailed and postmarked, and objections filed with or mailed to the court, by December 15, 2026.How Do You Take Action?
Claims are filed on the official Covenant Health Data Settlement website with the Class Member ID from the postcard, or on the paper claim form posted there. The claim form offers payment by Zelle, Venmo, PayPal, direct deposit or check. People who did not receive a postcard can reach the settlement administrator, Kroll, through the website's contact form.What Happens Next?
The court has not yet set the final approval hearing; the settlement website will post the date once it is scheduled. Class counsel's fee request and motion for final approval are due 45 days before that hearing. Payments go out within 45 days after the settlement becomes effective, and checks must be cashed within 180 days.Sources and Verification
• Official settlement website (Kroll, administrator): Covenant Health Data Settlement — home page, FAQ, documents and claim form• Settlement Agreement (filed August 6, 2026), Order Granting Preliminary Approval and Order Rescinding the September 1 order (both signed September 15, 2026), In re Covenant Health Data Security Litigation, No. PENSC-CV-2025-63 (Me. Super. Ct., Penobscot Cnty.)
• Long Form Notice, embedded below
Questions
Who qualifies for the Covenant Health data breach settlement?
The settlement class is all living people in the U.S. whose private information was compromised in the cyberattack on Covenant Health discovered in May 2025, including everyone who was sent a notice of the incident. The settlement agreement puts the class at about 502,606 people. Covenant Health's directors and officers and the judges in the case are excluded.
How much is the Covenant Health settlement payment?
Class members can claim a pro rata cash payment estimated at $75, with no documentation, and up to $5,000 for documented, unreimbursed losses from the incident; the two can be claimed together. The $75 estimate can rise or fall depending on how many valid claims are filed. Every class member also gets two years of CyEx Medical Shield Complete credit monitoring without filing a claim.
Is a Class Member ID needed to file a Covenant Health claim?
The online claim form begins by asking for the Class Member ID printed on the postcard notice. The paper claim form, which can be printed from the settlement website and mailed, asks for the Class Member ID if known. People who did not receive a postcard can contact the settlement administrator, Kroll, through the website's contact form.
What is the deadline for the Covenant Health settlement?
Claims must be submitted online by 11:59 p.m. Eastern on December 30, 2026, or mailed and postmarked by that date. The deadline to opt out or object is December 15, 2026. The court had not yet set a final approval hearing date as of October 20, 2026.
When will Covenant Health settlement payments be sent?
Payments go out within 45 days after the settlement becomes effective, which follows final approval and, if anyone objects, the end of any appeal. The final approval hearing has not been scheduled yet, so no payment date has been set. The credit monitoring codes become usable after final approval.
