Covenant Health has revised upwards the number of people affected by the data breach identified last May, raising it to nearly 500,000 .
See also: Coupang compensates 33.7 million data breach victims with $1.17 billion
Initially, in July, the health agency announced that the data of 7,864 people, however further investigation showed that the scope of the incident was much larger.
After completing most of the data analysis, Covenant Health now reports that a total of 478,188 people were affected. Covenant Health is a universal health care organization based in Andover, Massachusetts, that operates hospitals, nursing and rehabilitation facilities, assisted living facilities and senior care organizations in New England and parts of Pennsylvania.
Covenant Health was notified on May 26, 2025, that an attacker had breached its systems eight days earlier, on May 18, gaining access to patient data. In late June, the ransomware Qilin, stating that it removed 852 GB of data, including approximately 1.35 million files.
See also: Aflac: Data breach affects 22.6 million people
The organization says that information that may have been exposed includes names, addresses, dates of birth, medical record numbers, social security numbers, health insurance information, and treatment details (such as diagnoses, dates, and type of treatment).
In a copy of the relevant notification, Covenant Health notes that it has commissioned specialized external digital forensics experts to determine what data was affected and how many people were affected by the incident.
“This review is still ongoing,” the organization said, without giving a specific timeline for completing the investigation and fully assessing the consequences. At the same time, Covenant Health emphasizes that it has strengthened the security of its systems in order to prevent similar incidents in the future.
The health provider offers those affected 12 months of free identity protection services, aimed at identifying possible malicious use of their personal information.
See also: Nissan: Customer data breach due to Red Hat attack
As of December 31, the organization began sending data breach notification letters to patients whose information may have been leaked during the May attack.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
