Loading story…
Covenant Health, a Catholic healthcare provider operating across New England and Pennsylvania, suffered a major data breach in May 2025 after the Qilin ransomware group gained unauthorized access to its systems. The breach exposed sensitive information of approximately 478,188 patients, including names, addresses, dates of birth, medical record numbers, Social Security numbers, health insurance details, and treatment information. Initial reports underestimated the scale, but further forensic analysis revealed the true extent of the compromise. The attackers reportedly stole 852 GB of data, and Covenant Health has since offered affected individuals 12 months of free identity protection services while strengthening its cybersecurity measures.
The incident significantly disrupted operations at several hospitals, particularly St. Joseph Hospital and St. Mary’s Health System in Maine and New Hampshire, where lab services were limited and wait times increased due to the attack. The Qilin ransomware group, known for targeting healthcare and critical infrastructure globally, claimed responsibility for the breach and listed Covenant Health on its data leak site. Federal law enforcement was notified, and the organization began sending breach notification letters to victims at the end of December 2025. The investigation concluded in December, confirming the attackers maintained access to Covenant Health’s IT systems for over a week in May 2025.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
By early January 2026, Covenant Health updated its disclosures to say the May 2025 breach affected 478,188 individuals, far above the initial estimate. The revised total followed additional data analysis and included large numbers of patients in Maine and other northeastern states.
Covenant Health started sending additional notification letters to affected individuals on December 31, 2025. The notices included offers of credit monitoring or identity protection for eligible victims.
The Qilin ransomware gang claimed responsibility for the Covenant Health attack and said it exfiltrated 852 GB of data. Reported stolen information included patient names, Social Security numbers, medical record details, insurance information, diagnoses, and treatment data.
Covenant Health initially reported the May 2025 incident to federal regulators as affecting roughly 7,864 to 7,900 individuals. This early estimate was later found to significantly understate the scale of the breach.
Following detection of the attack, Covenant Health brought in third-party forensic specialists to investigate and notified federal law enforcement. The organization also began remediation and security-hardening efforts after taking systems offline.
On May 26, 2025, Covenant Health detected a ransomware attack later attributed to the Qilin group. The incident caused connectivity issues, system shutdowns, and service disruptions at hospitals and clinics, forcing some operations to revert to manual processes.
Investigators determined that an unauthorized third party gained access to Covenant Health's network on May 18, 2025. During this access window, attackers were able to reach files containing sensitive patient information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cognizant Technology Solutions, through its subsidiary TriZetto Provider Solutions, experienced a significant data breach that went undetected for nearly a year, exposing sensitive personal information such as Social Security numbers, financial account details, and home addresses. The breach, which affected at least 100 individuals across several states, led to multiple class-action lawsuits alleging delayed disclosure, insufficient notification to victims, and a lack of transparency regarding the incident's root cause and remediation. Plaintiffs argue that the delay in notification left affected individuals vulnerable to identity theft and financial fraud, while Cognizant and TriZetto have offered limited public comment due to ongoing litigation. Separately, Covenant Health, a major healthcare provider operating in several northeastern US states, suffered a ransomware attack by the Qilin group in May 2025. The attack compromised the data of over 478,000 individuals, leading to system shutdowns across hospitals and clinics and prompting the organization to hire cybersecurity experts for containment and investigation. Covenant Health initially reported a smaller number of affected individuals but later updated the total to nearly half a million, subsequently notifying patients and offering credit monitoring and identity protection services. Both incidents underscore the persistent cybersecurity risks facing the healthcare sector and the significant impact of breaches on patient privacy and organizational trust.
Jun 29, 2026
Several healthcare-related organizations disclosed **separate data breach incidents** involving ransomware, unauthorized network access, and third-party compromise. CommonSpirit Health said patient data was exposed through a downstream vendor chain after **Pinnacle Holdings Ltd** suffered a ransomware attack, with attackers present in the network from November 11 to November 25, 2024, and exfiltrating files before the incident was later relayed through **NorthGauge Healthcare Advisors**. Meadowlark Hills and MedPeds also disclosed breaches tied to the **Beast ransomware** group, while Tieu Dental reported unauthorized access to its network in July 2025 that exposed patient information including Social Security numbers, medical and insurance data. These incidents led to regulatory notifications and offers of credit monitoring or identity theft protection for affected individuals. A separate legal development involved **Geisinger Health** and **Nuance Communications**, where a judge approved a **$5 million settlement** over claims tied to a former Nuance employee's theft of medical records affecting about 1.3 million patients. That matter differs from the ransomware and breach notifications because it concerns civil litigation over an earlier insider data theft rather than a newly disclosed intrusion. Overall, the reporting reflects ongoing exposure of protected health information across the healthcare sector through both direct attacks and third-party relationships, with delayed notification timelines and incomplete early visibility into the full scope of compromised data remaining recurring issues.
Jun 29, 2026
MACT Health Board confirmed patient data theft tied to a **November 2025 ransomware attack** claimed by **INC Ransom**. The organization reported network access by an unauthorized party from **Nov 12–20, 2025**, followed by a file review completed **Jan 9, 2026**; exposed data may include patient names plus clinical information (e.g., diagnoses, test results, treatment details, medical images) and, for some individuals, **Social Security numbers**. MACT began mailing notification letters **Jan 23, 2026** and is offering credit monitoring/identity theft protection where SSNs were involved. Munson Healthcare separately notified more than **100,000** patients impacted by a **Cerner (Oracle Health) compromise** involving access to **two legacy Cerner servers** (unauthorized access beginning as early as **Jan 22, 2025**, detected **Feb 20, 2025**) containing data awaiting migration to the Oracle Cloud. Reported exposed data includes names, **SSNs**, and typical EHR content (medical record numbers, diagnoses, medications, test results, care details, and providers’ names); Cerner/Oracle Health engaged third-party incident response and notified law enforcement, and reporting indicates notification delays were influenced by law-enforcement requests and ongoing investigation, with litigation alleging the incident may have affected up to **80 hospitals**.
Jun 29, 2026