More than 280,000 patients in Maine are in line for a cash payment after their hospital operator filed a $2M class settlement in Penobscot County Superior Court. Covenant Health owns St. Joseph Healthcare in Bangor and St. Mary’s Regional Medical Center in Lewiston, both caught up in a May 2025 intrusion that exposed patient information across the two-state system.
The money is structured in two tiers. Anyone in the class can take an estimated $75 without paperwork, while patients who can document losses tied to the incident may claim up to $5,000. Claim forms are due December 30.
Benefits go past cash. Class members are automatically enrolled in credit monitoring, dark web monitoring, real-time authentication alerts, high-risk transaction monitoring, lost wallet protection, and identity theft insurance worth up to $1M. The settlement administrator is Kroll, reachable at (833) 453-2423, and the notice covers the May 18, 2025 unauthorized access to Covenant’s IT environment.
The complaint, filed by plaintiff Michael McClain, argued the breach was preventable and flowed from missing standard security practice, leaving patients exposed to identity theft and fraud. Covenant denies wrongdoing, saying it settled so attention stays on patients and residents rather than litigation.
The deal still needs a judge’s approval before anything pays out. Health system finance and risk teams should note the shape here: modest per-person cash, heavy identity services, and a claims deadline that lands barely two months after the filing.
