As first reported by News Center Maine, a class-action lawsuit has been filed against Covenant Health following a significant cybersecurity breach that forced hospitals in Lewiston and Bangor, Maine, to shut down access to critical data systems. The incident, first detected on May 25, led to the disruption of operations at St. Mary’s Health System and St. Joseph Healthcare, which are both under Covenant’s network.
Source: stmarysmaine.com.
The lawsuit, brought by plaintiff Michael McClain in Penobscot County, accuses Covenant of using inadequate and cost-cutting cybersecurity measures to protect patient data. While the health system has not confirmed whether any patient information was compromised, the suit claims the organization failed in its duty to safeguard private medical records. Covenant has declined to comment on the pending litigation but says it is working with external cybersecurity experts to investigate and recover from the breach.
Compounding the crisis, Central Maine Healthcare also reported a similar cyber incident shortly after Covenant’s, prompting speculation about a possible link. In response, MaineHealth—the state’s largest healthcare provider—has severed digital connections with both affected systems to prevent further risk. Covenant has advised patients to keep existing appointments while restoration efforts continue. The growing wave of cyberattacks across healthcare systems underscores the urgency of more robust digital defenses in the industry.
