Maine residents who received a breach notice from Central Maine Healthcare can file a claim under a $1,368,025 settlement. The agreement resolves the consolidated class action — a single lawsuit brought for a group of affected people — over unauthorized access to patient data from about March to June 2025, according to the official settlement website.
The settlement class covers U.S. residents whose private information may have been impacted and who were sent a breach notice, a group court papers put at about 218,884 mailed notices, as reported by HIPAA Journal in its settlement summary. Maine patients in that notice group must choose one cash benefit and file by September 28, 2026.
Official resources:
- Explore the official data from Securityaffairs — Use this primary source to review the underlying data.
- Explore the official data from Federmanlaw — Use this primary source to review the underlying data.
Table of Contents
- Who is eligible to file?
- What happened to patient data?
- What payment and monitoring can you get?
- How do you file and meet the deadlines?
Who is eligible to file?
You qualify if you live in the United States and Central Maine Healthcare mailed you a notice that your private information may have been affected. That notice is the key test. Without it, you are not part of this class.
Maine residents fall inside the national class because the breach involved patients of Central Maine Healthcare and Central Maine Medical Center. Keep the mailed notice with your records. You will need the information on it to verify your claim.
What happened to patient data?
Central Maine Healthcare detected unusual IT activity on June 1, 2025. It later determined an unauthorized party had access from March 19 through June 1, 2025, with its investigation concluding November 6, 2025, according to SecurityAffairs citing the Maine Attorney General filing in its breach report.
Potentially accessed files included names, birth dates, treatment details, dates of service, provider names, and health-insurance information. Social Security numbers were included for some patients. The range matters because patients face different follow-up risks when medical and financial identifiers are exposed together.
What payment and monitoring can you get?
Eligible claimants must choose one of two cash options. One path offers reimbursement up to $5,000 for documented, unreimbursed losses tied to the breach, with proof required. The other path offers an estimated $50 pro-rata cash payment without documentation, meaning the final amount can shift with the number of claims, according to the official claims instructions.
Pro-rata means the fund is divided among approved claimants. You cannot receive both cash payments. You may also elect one year of free medical-records monitoring in addition to either cash option. That monitoring focuses on medical records activity, so continue watching bank, credit, and insurance statements separately.
How do you file and meet the deadlines?
File online or by mail, and mail claims must be received by September 28, 2026. Exclusion requests must be sent by September 13, 2026, before the final fairness hearing on October 28, 2026. The case was handled in Maine's Business and Consumer Court for Androscoggin County as a compromise to avoid litigation cost and uncertainty, with no established finding of liability.
- Confirm you received the mailed breach notice.
- Select either documented reimbursement or the no-documentation payment.
- Add the one-year medical-records monitoring choice if you want it.
- Submit online or ensure mail arrival by September 28, 2026.
You Might Also Like
- Data Breach Reported at Arizona State University Draws Lawyer Investigation
- Government of Canada Class Action Lawsuit Accepting Claims for Eight Million Dollar Settlement
- Why a State Attorney General Settlement Is Different From a Consumer Refund Program