Central Maine Healthcare cyberattack

Analyst assessment

Central Maine Healthcare shut down its information technology applications, hardware, network servers and phone systems June 1, 2025, after detecting unusual activity. The health system’s initial statement said Central Maine Medical Center in Lewiston, Bridgton Hospital, Rumford Hospital and outpatient offices remained open. Our initial reporting documented the resulting disruption and possible rescheduling of elective care. This incident affected Central Maine Healthcare; contemporaneous outages at Covenant Health involved a separate organization.

The completed investigation later established that an unauthorized party accessed the IT environment between March 19 and June 1. That intrusion period precedes the documented operational shutdown. The health system said patient files may have been accessed or acquired, including names, birth dates, treatment information, service dates, provider names, insurance information and, for some patients, Social Security numbers. The evidence confirms an intrusion, while leaving the extent of file acquisition uncertain.

Operational significance

The shutdown disrupted clinical coordination and routine communications across the system without closing its hospitals. A June 12 patient update said automated appointment reminders were unavailable and providers could not access medical records. Staff used manual calls and prioritized record requests. Patients could still view some information through MyHealthlink; the health system later explicitly clarified that the patient portal had remained available throughout the outage, although providers could not connect.

Radiation treatment depended on restoring and validating the technology supporting the system’s linear accelerators. A June 25 update announced full restoration of radiation therapy and said affected patients were being contacted to reschedule. The chief executive’s June 30 message announced full system restoration and acknowledged the paper processes used during the interruption.

Technical recovery left a care-coordination backlog. The July 2 restoration update described accumulated prescription requests and patient messages, delayed results and procedures, rescheduling work and newly restored medical-record processing. Intermittent pharmacy phone problems were reported that afternoon and reported resolved July 3. Those announcements establish separate recovery milestones; they do not establish when every outstanding prescription, message or appointment was completed.

Confidence and uncertainty

Confidence is high that unauthorized network access caused a defensive shutdown with documented health care disruption. The reviewed sources do not establish ransomware deployment, a ransom demand, a responsible group, a payment or a verified leak-site publication. Searches under the health system’s name, domain, abbreviations and named hospitals produced no matching ransomware claim. An unrelated result for Baraga County Memorial Hospital was excluded. Ransomware and actor attribution remain unresolved.

The investigation was completed Nov. 6, and the issuer said patient notification ran from July 31 through Dec. 29. A supplemental issuer notification and attached sample letter, available as a public copy, also identifies potentially affected current and former employees and driver’s license information. It states that 138,793 Maine residents were notified in the December round; that state-specific figure is not a verified nationwide total. The file-access language remains qualified, and the copy’s publication date has not been established.

The court-authorized settlement notice describes a proposed $1,368,025 settlement in In re Central Maine Data Security Litigation, docket ANDSC-CIV-2025-00083. The defendants deny wrongdoing, and the notice says the court has made no determination on liability. The administrator lists a final approval hearing for Oct. 28, 2026, after this research cutoff. The proposal is not recorded as a final judgment or completed payment.

Analytic gaps

The initial access method, any malware used, exact files acquired, a verified nationwide affected-person count, clinical cancellation totals, measurable patient harm and total operational costs remain unresolved. The issuer’s first June 2 statement described unusual activity and shutdown; its final notice retrospectively establishes July 31 as the start of notifications. The original July 31 notice was not independently recovered in this pass, so the precise first explicit acknowledgment is bounded by that evidence. Core systems were restored June 30, but no reviewed source fixes a final date for clearing all residual backlogs. The incident is assessed as presumed resolved, with no exact overall end date assigned.