Covenant Health Data Breach Exposes Personal and Medical Records of 400,000 Individuals On January 5, 2026, Covenant Health, a New England-based healthcare provider network, disclosed a cybersecurity incident that compromised the sensitive data of over 400,000 individuals. An unauthorized actor accessed Covenant’s systems, potentially exfiltrating personally identifiable information (PII) and protected health information (PHI), including names, addresses, dates of birth, Social Security numbers, medical record numbers, and treatment details such as diagnoses and care histories. The breach is under investigation by Lynch Carpenter LLP, a national class action law firm, which is reviewing potential legal claims on behalf of affected individuals. Covenant Health serves multiple locations across New England, though the full scope of impacted facilities has not been specified. No details have been released regarding the attack vector, timeline of the intrusion, or whether ransomware or other malicious tools were involved. The incident highlights ongoing risks to healthcare data security, as providers remain prime targets for cybercriminals seeking valuable medical and financial records.

Covenant Health, a Catholic healthcare organization, suffered a cyberattack that forced three of its hospitals to shut off all access to data systems. The incident impacted St. Joseph Hospital and St. Mary’s Health System in Maine, and St. Joseph Hospital in New Hampshire. The attack caused technology outages, affecting phones and internet access, and leading to longer wait times and limited lab services. Despite the disruptions, healthcare services continued with some adjustments. No cybercriminal group has claimed responsibility for the attack.