Covenant Health data breach impacted 478,000+ people
Massachusetts-based Covenant Health has reported to authorities that over 478,000 individuals were impacted by a data breach discovered in May 2025.
Initially, the organization estimated that the incident affected the data of 7,864 people, but after finishing “the bulk of its data analysis,” Covenant Health has corrected the number to 478,188 impacted individuals.
On December 31st, Covenant Health informed patients whom it believed at the time to be affected that it discovered unusual activity in its IT environment on May 26th. During the investigation, the organization learned that attackers breached its systems eight days earlier, on May 18th, and were able to access patient data.
The updated breach notification letters to patients says that the data included patients’ names and one or more of the following: addresses, dates of birth, medical record numbers, Social Security numbers, health insurance information, and treatment information, such as diagnoses, dates of treatment, and/or type of treatment.
The Qilin ransomware group claimed the attack in June 2025, saying that it stole over 1.3 million files totalling 850 GB.
Cisco Talos researchers published a study that in the second half of 2025, Qilin published information on more than 40 victims per month on its leak site. In this case, security reporting suggests that Qilin has made at least some of the stolen data public and posted images of samples.
In the aftermath of the incident, Covenant Health engaged third-party forensic security experts and improved the security of its IT environment.
The organization says it is offering complimentary credit monitoring and identity protection services to Massachusetts residents whose Social Security numbers may have been involved. It has also set up a toll-free call center to address questions about the incident.
Covenant Health is a Catholic healthcare organization based in Andover, Massachusetts operating hospitals, rehabilitation centers, assisted living residences, and offering healthcare services across New England and parts of Pennsylvania.
