Covenant Health $2 Million Data Breach Settlement, Who Qualifies for Up to $5,000 or $75, and How to File a Claim by December 30, 2026

Covenant Health, Inc. and three affiliated entities have agreed to pay $2 million to settle a class action over a May 2025 data breach that may have exposed patients’ personal and health information. If you were sent a breach notice, you can claim up to $5,000 for documented losses or an estimated $75 cash payment with no proof of loss, plus two years of credit and medical identity monitoring.

The claim deadline is December 30, 2026. The deadline to opt out or object is December 15, 2026. The defendants deny wrongdoing, and the settlement still needs final court approval. The $75 figure is an estimate, not a guarantee.

Official settlement website: https://covenanthealthdatasettlement.com/ File a claim online: https://forms.ksacms.com/efiling/fr/tform/covenanthealth_claimform/new?form-version=1&fr-wizard-page=section-1

Quick Facts: Covenant Health Data Breach Settlement

Detail	Information
Official settlement website	https://covenanthealthdatasettlement.com/
Online claim form	https://forms.ksacms.com/efiling/fr/tform/covenanthealth_claimform/new?form-version=1&fr-wizard-page=section-1
Case	In re: Covenant Health Data Security Litigation
Case number	PENSC-CV-2025-63
Court	Superior Court of Penobscot County, Maine
Defendants	Covenant Health, Inc.; St. Joseph Healthcare Foundation; St. Joseph Hospital; St. Joseph Hospital, Nashua, N.H.
Settlement fund	$2,000,000
Breach date	On or around May 18, 2025
Who may qualify	U.S. residents whose private information was compromised in the breach and who were sent a breach notice
Cash Payment A	Up to $5,000 for documented, unreimbursed losses
Cash Payment B	Estimated $75 (pro rata, may change), no proof required
Credit monitoring	Two years
Claim deadline	December 30, 2026 (online, or mail postmarked by that date)
Opt-out and objection deadline	December 15, 2026
Final approval hearing	Not yet set. Check the website
Settlement administrator	Kroll Settlement Administration LLC
Class counsel (as reported)	Federman & Sherwood; Ahdoot & Wolfson, PC

What Happened in the Covenant Health Data Breach?

According to the settlement website, an unauthorized party accessed Covenant Health’s IT environment on or around May 18, 2025. Covenant Health says it learned of unusual activity on May 26, 2025 and began mailing notice letters on July 11, 2025. Covenant Health operates St. Joseph Hospital in Nashua, New Hampshire, St. Joseph Healthcare in Bangor, Maine, and St. Mary’s Health System in Lewiston, Maine.

The information involved varies by person. Settlement materials list names, addresses, dates of birth, Social Security numbers, medical record numbers, health insurance information, dates of treatment, diagnoses and treatment details. That does not mean every person had every category exposed, and it does not prove any person’s identity was misused. Public reporting has put the number of affected people at about 478,000 (reported as 478,188 in connection with a separate lawsuit). The settlement FAQ does not state that figure as its class count, so eligibility depends on the class definition.

The plaintiffs allege that the defendants failed to adequately protect patients’ private information. The defendants deny that and agreed to settle to avoid the cost and uncertainty of litigation. The settlement is not a court finding that Covenant Health violated any law.

Who Qualifies?

You may be a class member if all of these apply:

• You reside in the United States.
• Your private information was compromised in the May 2025 incident.
• You were sent a notice about the incident.

Being a Covenant Health patient is not enough by itself. Your notice includes a Class Member ID that you need for the online claim form. The class excludes the defendants’ directors and officers, the assigned judges, their immediate families and court staff, and anyone who properly opts out.

Lost your notice? Contact Kroll to ask about verifying your membership. Not having a letter does not automatically disqualify you, but you must still be in the class under the settlement rules.

What the Settlement Provides

Cash Payment A: documented losses (up to $5,000). This covers documented, unreimbursed losses caused by the breach. You need third-party records such as receipts, invoices, credit card statements or phone bills. Self-prepared documents alone are not enough, though you can use them alongside other evidence. Examples that may qualify, subject to the settlement rules, include unreimbursed fraud charges, bank or card fees caused by the incident and similar documented expenses. If a documented-loss claim is rejected and you do not fix the problem, the FAQ says it is treated as an election of the pro rata payment.

Cash Payment B: pro rata payment (estimated $75). No documentation is needed. Select it on the claim form. The amount can rise or fall depending on valid claims and the money left after other costs.

Credit monitoring (two years). A published summary identifies the product as CyEx Medical Shield Complete, which includes credit monitoring, dark web monitoring, real-time alerts, lost wallet protection and identity theft insurance up to $1 million. No documentation is required. The official site says you remain eligible for monitoring even if you do not file a cash claim. Check the FAQ for how to activate it.

Can you get both A and B? The settlement treats them as alternative cash options, so do not assume you can collect both. Read the claim form and FAQ before choosing. Monitoring is a separate benefit.

Leftover money. Any amount left after all payments goes to a court-approved nonprofit.

Where the $2 Million Goes

The $2 million is the total fund, not the amount divided among affected people. According to the settlement FAQ, money is paid in this order:

1. Settlement administration costs.
2. Court-approved attorneys’ fees, expenses and service awards. Class counsel can ask for up to one-third of the fund (about $666,667), plus expenses. Class representatives may receive $2,500 each, reported as $27,500 total. These are requests the court decides.
3. Credit monitoring for valid claims.
4. Documented-loss payments.
5. Pro rata cash payments from whatever remains.

Because monitoring and documented losses are paid before the pro rata payments, the number of valid claims affects the $75 estimate. More claims means smaller shares.

How to File a Claim

1. Find your breach notice and Class Member ID.
2. File online at the official claim portal, or print the paper form and mail it to: In re: Covenant Health Data Security Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391.
3. Choose Cash Payment A or B. For A, attach third-party documentation.
4. Submit online by December 30, 2026, or mail the form postmarked by that date.

Filing is free. Do not pay anyone who promises to file or guarantee a payment. Reported payout options include Zelle, Venmo, PayPal, direct deposit or a mailed check. Keep your confirmation and a copy of your documents.

Your Options and Deadlines

Option	What happens	Deadline
Submit a claim	The only way to get a cash payment	December 30, 2026
Opt out	No settlement benefits. You keep any right to sue the defendants over the covered claims	Postmarked by December 15, 2026
Object	You stay in the class and tell the court what you dislike. You can still file a claim	December 15, 2026
Do nothing	No cash payment. You are bound by the release, but remain eligible for credit monitoring	None

How to Opt Out

Mail a signed written request to In re: Covenant Health Data Security Litigation, c/o Kroll Settlement Administration LLC, ATTN: Opt-Out Request, P.O. Box 225391, New York, NY 10150-5391, postmarked by December 15, 2026. State that you want to be excluded from the case (No. PENSC-CV-2025-63) and include your full name, mailing address, phone number and email (if any) and signature. Whether an individual lawsuit is practical depends on the facts and the law.

How to Object

File or mail a written objection to the court by December 15, 2026, and mail copies to class counsel, the defendants’ counsel and the administrator, all postmarked by that date. You cannot object as a class member if you opt out.

Important Dates

Date	Event
May 18, 2025	Unauthorized access begins
May 26, 2025	Covenant Health says it learned of unusual activity
June 2025	Class action filed in Penobscot County, Maine
July 11, 2025	Covenant Health begins mailing notices
January 6, 2026	Separate federal suit, Wickett v. Covenant Health, No. 1:26-cv-10044, reportedly filed in Massachusetts
December 15, 2026	Opt-out and objection deadline
December 30, 2026	Claim deadline
Not set	Final approval hearing

Payments and monitoring codes go out after final approval and after any appeals are resolved. No payment date is confirmed. The website will post the hearing date once the court sets it.

What Laws Apply to Healthcare Data Breaches?

HIPAA

HIPAA’s Privacy and Security Rules (45 C.F.R. Parts 160 and 164) require covered providers to protect health information, including risk analysis, access controls, training and incident response. Its Breach Notification Rule (45 C.F.R. §§ 164.400 to 164.414) requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery, notice to the Department of Health and Human Services, and media notice for breaches affecting more than 500 residents of a state. The HHS Office for Civil Rights enforces HIPAA. HIPAA does not give patients a private right to sue for damages, so data breach class actions rely on other legal theories.

Federal Trade Commission Act

Section 5 of the FTC Act (15 U.S.C. § 45) lets the FTC pursue unfair or deceptive practices, including inadequate data security. It gives individuals no private right to sue.

State Breach Notification Laws

Every state has one. Maine’s law (10 M.R.S. § 1346 et seq.) and New Hampshire’s (RSA 359-C:19 to :21) require notice to affected residents and, in some cases, regulators, with deadlines that differ by state. The dates here do not by themselves show a notice was late. Covenant Health says it learned of the activity on May 26 and mailed letters on July 11, about 46 days later, which was within HIPAA’s 60-day outer limit. Whether state deadlines were met is a separate legal question this article does not answer.

Civil Claims Used in Data Breach Cases

• Negligence. The plaintiff must show a duty, a breach, causation and damages. The defendant can dispute each element.
• Negligence per se. A statutory violation may help establish breach, but courts limit it to the right statute, protected class and kind of harm.
• Breach of contract or implied contract. Patients may argue privacy policies or the parties’ conduct created obligations.
• Unjust enrichment. Plaintiffs may argue a provider benefited from skimping on security. Availability depends on state law.
• State consumer-protection laws, such as Maine’s Unfair Trade Practices Act, may also be pleaded.

In federal court, plaintiffs must also show a concrete injury to have standing (TransUnion v. Ramirez, 2021), which is often contested in breach cases. The Maine case is in state court. Settling avoids deciding these disputes, and the settlement should not be read as proof that any law was violated.

Why Medical Data Breaches Carry Special Risk

A password can be changed. A Social Security number, birth date and medical history are much harder to replace, and together they can help someone impersonate you. Potential consequences include fraudulent accounts or loans, fraudulent medical claims, misuse of medical identifiers, targeted phishing that uses details of your treatment, and exposure of sensitive health information. Medical identity theft can also put false information into your medical record. These are risks, not proof that every affected person suffered any of them.

What Affected Patients Should Do Now

1. Read your notice to see which information it says was involved.
2. Check your credit reports for free at AnnualCreditReport.com.
3. Consider a credit freeze at all three nationwide bureaus. Federal law makes freezes free to place and lift. A fraud alert is another option.
4. Review medical insurance statements and explanations of benefits for services you did not receive.
5. Secure accounts with unique passwords and multifactor authentication, and be wary of unexpected calls or messages that claim to be from a hospital or insurer.
6. Save records of fraud, fees and time lost if you may claim documented losses.
7. Report identity theft at IdentityTheft.gov if you think your Social Security number was misused.

Settlement payments may be taxable income, depending on your situation. Ask a tax professional if you are unsure.

Related Coverage

We already covered this breach and its lawsuits in Covenant Health Data Breach Lawsuit: 478,000 Patients Face Identity Theft Risk After Ransomware Attack, What You Need To Know. For comparison with other healthcare breach settlements, see the Esse Health $2.525M data breach settlement. For help preparing a claim, see How to Claim a Lawsuit Settlement Money? Step-by-Step Guide (2026).

When comparing settlements, look at the money available per person, the number of eligible people, the evidence required and whether monitoring is included, not just the total fund.

How to Contact the Settlement Administrator

• Website: https://covenanthealthdatasettlement.com/
• Phone: (833) 453-2423
• Mail: In re: Covenant Health Data Security Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391

Frequently Asked Questions

Is the Covenant Health settlement approved?

Not yet. It is a proposed settlement awaiting final court approval, and the hearing date has not been set as of October 20, 2026.

How much can I get?

Up to $5,000 with documented losses, or an estimated $75 with no proof. You can also get two years of credit monitoring. The $75 can change.

What is the claim deadline?

December 30, 2026, online or postmarked if mailed.

Do I need receipts for the $75 payment?

No. The pro rata option needs no documentation. The $5,000 option needs third-party records.

Can I claim without losing money?

Yes. If you are in the class, you can choose the pro rata payment without proving a loss.

Can I get both $5,000 and $75?

They are alternative cash options. Review the claim form and FAQ before choosing.

What if I do nothing?

You get no cash payment, you are bound by the release if the settlement takes effect, and you remain eligible for credit monitoring.

I received free monitoring in 2025. Does that matter?

That offer came from Covenant Health directly. The settlement adds a separate two-year benefit, and accepting the earlier offer does not stop you from filing a claim.

Does the settlement prove Covenant Health violated HIPAA?

No. The defendants deny wrongdoing, and the settlement is not a finding of liability.

When will payments arrive?

After final approval and the resolution of any appeals. No date is confirmed.

How do I know the website is real?

Use https://covenanthealthdatasettlement.com/ and the administrator’s contact details above. Never pay a third party to file a claim.

Sources

1. Official settlement website, In re: Covenant Health Data Security Litigation, No. PENSC-CV-2025-63: https://covenanthealthdatasettlement.com/ (Kroll), including its FAQ and documents pages.
2. Long Form Notice and Settlement Agreement (August 6, 2026), posted on the official website.
3. Official online claim form: https://forms.ksacms.com/efiling/fr/tform/covenanthealth_claimform/new?form-version=1&fr-wizard-page=section-1
4. Covenant Health, Notice of Data Security Incident (July 11, 2025).
5. ClassAction.org, coverage of Wickett v. Covenant Health, Inc., No. 1:26-cv-10044 (D. Mass.).
6. WABI, “Class action lawsuit filed against St. Joseph Hospital and Covenant Health following data breach” (June 2025).
7. HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164 (hhs.gov).
8. Federal Trade Commission Act § 5, 15 U.S.C. § 45; 10 M.R.S. § 1346 et seq.; N.H. RSA 359-C:19 to :21.
9. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
10. AnnualCreditReport.com and IdentityTheft.gov.

Written by Israr Ahmad, legal content researcher at AllAboutLawyer.com. Last updated October 20, 2026. This article is general information, not legal or tax advice. AllAboutLawyer.com is not a law firm and is not affiliated with Covenant Health or the settlement administrator. Eligibility, payment amounts and deadlines are controlled by the official settlement documents, and the settlement remains subject to final court approval. Verify details on the official settlement website.