Analyst assessment
Covenant Health’s May 2025 cyberattack disrupted hospital information systems, communications and clinical workflows in Maine and New Hampshire. In its patient notice, Covenant said an unauthorized party entered its IT environment May 18 and accessed some patient information. Covenant detected unusual activity May 26 and disconnected data systems while securing and restoring its environment. DysruptionHub assesses the cyber incident with high confidence because the organization’s findings corroborate contemporaneous accounts of the shutdown.
The effects included intermittent phone and internet service, unavailable electronic documentation and restrictions on laboratory access. The Record’s May 30 reporting identified St. Joseph Healthcare in Bangor, St. Joseph Hospital in Nashua and St. Mary’s Health System in Lewiston as affected hospitals. Our Lewiston reporting also described disruption at Community Clinical Services, an independently governed provider that retained IT connections with St. Mary’s.
Operational significance
Hospitals continued providing care while adapting workflows. St. Mary’s May 28 notice described longer waits and paper laboratory orders. In Nashua, laboratory services were restricted to the main hospital campus with physical orders. A Covenant spokesperson told the Portland Press Herald that St. Mary’s intermittently diverted neurological and stroke cases May 26–30. This establishes specific care disruption without implying that all hospital services stopped.
St. Mary’s was providing full clinical services by June 13, although patients still reported communication and test-result delays. A July 14 report said its computer system had been fully restored for roughly two weeks, after taking about a month to return online. These accounts support recovery but do not establish an exact date when every affected Covenant system returned to normal. With no evidence of continuing operational disruption, the incident is presumed resolved.
The consequences extended beyond the immediate outage. Covenant’s 2025 audited financial statements report revenue loss and expenses from the cyber incident exceeding $30 million. That figure combines lost revenue and expenses; it does not identify a ransom payment. A resident-information notice named 10 eldercare affiliates potentially affected by the same incident. Their inclusion in the data review does not establish clinical outages at each facility; contemporaneous reporting described minimal clinical impact at post-acute facilities using a different platform.
Confidence and uncertainty
Covenant’s notices establish unauthorized access to patient information, with potentially involved categories varying by person and including identifying, treatment and insurance information. The organization began patient notifications July 11, 2025, and issued additional notifications after further review. A later resident review led to letters in February 2026. Publicly reported counts changed during this process and should not be read as one final total covering every affected population.
Qilin claimed responsibility in late June 2025 and alleged it took 852 gigabytes of data containing about 1.35 million files, according to BleepingComputer. The claim matches Covenant’s correct domain, covenanthealth.net. Attribution is assessed with medium confidence on that independently reported claim; Covenant’s notices do not confirm Qilin, encryption or the alleged data volume. Confidence that ransomware encryption occurred is low.
Analytic gaps
The public record does not establish the initial access method, a ransom demand or payment, the final aggregate exposure count, or a complete facility-by-facility restoration chronology. The court-authorized settlement website describes a proposed $2 million settlement and says defendants deny wrongdoing. Final approval remains pending; the proposal does not establish liability or completed compensation.
