Owner of St. Joseph Hospital agrees to pay $2M to settle data breach lawsuit

The owner of St. Joseph Hospital in Bangor has agreed to pay $2 million to settle a class-action lawsuit over a major data breach last year.

In the 86-page settlement submitted to Penobscot County Superior Court, Covenant Health agreed to make two payments into an escrow account to cover claims stemming from the May 2025 infiltration of the system’s IT network.

Those affected by the data breach can receive a maximum payment of $5,000 for documented losses for which they haven’t already been reimbursed, according to the proposed settlement. But people can get a $75 cash payment without proving any losses. Covenant Health also will provide free credit monitoring for two years.

St. Joseph was hit by a cyberattack in May 2025, prompting the hospital to take its data systems offline.

That prompted a class-action lawsuit accusing the hospital and its parent company of negligence in protecting patient information. Among the information potentially compromised in the attack are Social Security numbers, dates of birth, names, phone numbers, emails and health information.

More than 500,000 patients, including nearly 300,000 in Maine, were affected by the data breach, vastly larger than the approximately 8,000 originally reported .

In addition to St. Joseph, Covenant owns St. Mary’s Health System in Lewiston and St. Andre Health Care in Biddeford.

As part of the proposed settlement, Covenant Health and its hospitals admit to no wrongdoing and patients participating in the settlement won’t pursue further legal action related to the data breach.