Covenant Health Data Breach Exposes Personal and Medical Data of 478,000 Individuals Covenant Health, a Massachusetts-based healthcare provider operating across six states, confirmed a significant data breach affecting 478,188 individuals after a cyberattack in May 2025. The incident, discovered on May 26, involved unauthorized access to sensitive patient information, including names, dates of birth, addresses, Social Security numbers, medical record numbers, health insurance details, and treatment records. The attack, claimed by the Qilin ransomware group in June 2025, reportedly resulted in the theft of 1.3 million files (850 GB). The stolen data was later published online, suggesting Covenant Health did not pay the ransom. The organization initially reported only 7,800 affected individuals to the Maine Attorney General’s Office in July but revised the figure to 478,188 in a December 31 update after completing its investigation. Covenant Health serves patients in Massachusetts, Maine, New Hampshire, Pennsylvania, Rhode Island, and Vermont, making this one of the largest healthcare breaches in recent months. The delayed disclosure and underreported initial impact highlight the challenges in accurately assessing the scope of such incidents.