Cyberattack on Advanced Family Surgery Center Exposes Sensitive Patient Data On November 26, 2025, the ransomware group Genesis notified Advanced Family Surgery Center (AFSC), a Tennessee-based facility under Covenant Health, that they had breached its systems. Despite initial contact and attempted negotiations, no resolution was reached. By January 11, Genesis listed AFSC on its dark web leak site, claiming to have exfiltrated 100 GB of data, including: - Protected health information (surgical records with patient names, dates of birth, Social Security numbers, insurance details, and procedure notes) - Personal and financial data - Operational and file-server records A file tree posted by the threat actors confirmed the breach, with DataBreaches verifying the authenticity of exposed records. On January 19, when contacted for comment, Covenant Health initially questioned whether the inquiry was intended for them, suggesting a possible lack of awareness about the incident. As of publication, no data has been leaked, though Genesis indicated an upload was in progress. Under HIPAA regulations, affected entities must notify patients and the U.S. Department of Health and Human Services (HHS) within 60 days of discovery a deadline AFSC appears to have missed. No public breach notification from Covenant Health or AFSC has been identified, nor does the incident appear on HHS’s breach reporting tool. Further updates may follow if additional responses or disclosures emerge.

Cybersecurity Breach at Covenant Health Impacts Over 280,000 Mainers Covenant Health, the owner of St. Mary’s Hospital in Lewiston, Maine, has disclosed a significant expansion of a previously reported data breach. Initially believed to have affected approximately 4,600 Mainers when first reported in July, the incident has now been confirmed to impact over 280,000 individuals—a more than sixtyfold increase in the estimated scope. The amended breach notification, filed with the Maine Attorney General’s Office, follows further investigation into the incident. Covenant Health is offering credit monitoring and identity theft protection to those affected. The breach’s full extent and the nature of the exposed data remain under review, though the scale suggests a substantial compromise of sensitive information. The disclosure comes amid unrelated regional incidents, including a New Year’s morning fire in Manchester that left one dead and eight hospitalized, as well as a privacy lawsuit filed by a former Naked and Afraid contestant against Kennebec County, alleging misconduct by officials. Meanwhile, Ashley Furniture announced plans to open a 44,900-square-foot store in South Portland by early 2026, creating 45 new jobs.

Covenant Health Discloses Massive Data Breach Affecting Nearly 500,000 Patients Covenant Health, a Massachusetts-based Catholic healthcare system serving New England and parts of New York, has reported a major data breach impacting 478,188 individuals, with over half residing in Maine. The incident, stemming from a network intrusion in May 2025, exposed sensitive personal and medical information, triggering regulatory notifications and identity protection measures. The breach was detected on May 26, 2025, after unusual activity was observed in Covenant Health’s IT systems. A forensic investigation by an unnamed third-party cybersecurity firm revealed that an unauthorized actor had gained access to the network eight days earlier, on May 18. The intruder accessed a range of patient data, including: - Full names - Addresses - Dates of birth - Social Security numbers - Medical record numbers - Health insurance details - Treatment information (diagnoses, service dates) Covenant Health completed its internal review in December 2025 and began notifying affected individuals in two phases—first in July 2025 and again on December 31, 2025. The organization has since implemented remediation efforts, including system restoration, forensic analysis, and law enforcement engagement. As a precaution, affected patients are being offered a free one-year membership to Experian IdentityWorks, covering credit monitoring, fraud consultation, and identity theft restoration. While no evidence of data misuse has been reported, the breach underscores the ongoing risks to healthcare data security, particularly for organizations subject to HIPAA and state privacy regulations. Covenant Health has set up a dedicated call center to address patient inquiries related to the incident.