Living U.S. residents whose private information was compromised in the May 18, 2025 Covenant Health incident qualify to file, including everyone mailed a breach notice.
A data breach settlement is a court-approved fund that pays eligible people without a trial. Covenant Health and affiliates agreed to a $2,000,000 fund to resolve consolidated litigation over the attack. HIPAA Journal reports the class covers about 502,606 people, principally patients of Covenant facilities, in its HIPAA Journal settlement report.
Official resources:
- Check eligibility on Openclassactions’s official study page — Use this page to check the study’s participation requirements.
- Read the official notice from Covenanthealth — Use this primary source to verify the official announcement.
Table of Contents
- Who counts as a class member?
- What happened and what was exposed?
- What payment and monitoring can you get?
- How do you file on time?
Who counts as a class member?
The test is compromise plus notice, not patient status alone. OpenClassActions describes the qualifying class as living U.S. residents with compromised information in the incident, including all notice recipients, in its OpenClassActions settlement summary.
That group centers on patients of St. Joseph Hospital in Bangor, Maine, St. Joseph Hospital in Nashua, N.H., and other Covenant facilities. Being a Covenant patient alone does not qualify without compromised information and notice.
- Living U.S. resident at filing time
- Private information compromised in the May 18, 2025 incident
- Mailed a breach notice beginning July 11, 2025
What happened and what was exposed?
Covenant Health states unauthorized access began May 18, 2025, was detected May 26, 2025, and notices began mailing July 11, 2025, in its Covenant Health cybersecurity notice. Exposed data varied by person.
It could include name plus address, birthdate, medical-record number, Social Security number, diagnosis or treatment details, and health-insurance information. Your letter matters because it identifies the categories tied to you.
What payment and monitoring can you get?
Eligible claimants can seek up to $5,000 for documented unreimbursed losses. eosguide lists that cap plus an estimated $75 pro-rata cash payment and two years of CyEx Medical Shield Complete monitoring in its eosguide benefit breakdown.
Save receipts, bank statements, and insurer denial letters tied to the breach. The $75 payment may shift with claim volume because it is pro-rata.
How do you file on time?
OpenClassActions lists online claims due by 11:59 p.m. ET Dec. 30, 2026, or mailed claims postmarked that day, using the Class Member ID from the notice. Opt-outs and objections are due Dec.
15, 2026. Payments await final approval in In re: Covenant Health Data Security Litigation, No. PENSC-CV-2025-63, Penobscot County Superior Court, preliminarily approved Sept. 15, 2026. File only once for yourself and keep a copy of the confirmation.
- Find the Class Member ID on your notice
- File online before the ET deadline or mail with a Dec. 30 postmark
- Attach proof for any loss claim