Covenant Health data breach settlement
Yes. The Covenant Health data breach settlement is real: a $2 million class action settlement in the Superior Court of Penobscot County, Maine, run by Kroll Settlement Administration. Claims are open until 30 December 2026, on covenanthealthdatasettlement.com only.
Claims are open until December 30, 2026; the site shows the final approval hearing as Month XX, 2027 and says it will be updated once the court sets a date.
Is it real?
Yes. The case is In re: Covenant Health Data Security Litigation, case number PENSC-CV-2025-63, in the Superior Court of Penobscot County, Maine. The court appointed Kroll Settlement Administration to run it, and its only official site is covenanthealthdatasettlement.com.
How the real notice reached people. A Postcard Notice by mail; the FAQ says the postcard included a unique code for the credit monitoring benefit, which activates after final approval. People without a postcard or code can call (833) 453-2423 or use the Contact Us form. The site says it is the only authorized Settlement Website for this case; no other scam warning is published.
To tell a real message from a scam:
- The only official site is covenanthealthdatasettlement.com.Type it into your browser yourself rather than tapping a link. Claim pages on news and lawyer-advertising sites, and lookalike addresses, are not the administrator.
- Filing costs nothing.No real settlement charges a fee to file a claim or to release a payment. Anyone asking for one is running a scam.
- Nobody needs your passwords.The administrator never asks for your Covenant Health password, your online banking login or a code texted to you. Payment details go only into the claim form on covenanthealthdatasettlement.com.
- Check by phone.If you aren’t sure a message is real, call the administrator on (833) 453-2423, the number on covenanthealthdatasettlement.com, not one in the message.
Who qualifies
All persons residing in the United States whose Private Information was compromised by the May 2025 Data Incident and who were sent notice of it. Patients of any Covenant Health facility may be included. Excludes the defendants' directors and officers, the judges and their families and court staff, and anyone who opts out.
It covers people in the United States only. If you live elsewhere, you are not part of it, whatever a message says.
How much
The total settlement is $2,000,000. What each person can claim:
| Benefit | Amount | Notes |
|---|---|---|
| Cash Payment A: Documented Losses | up to $5,000 | documented, unreimbursed losses from the incident with third-party proof such as receipts, invoices, card statements or phone bills; a rejected and uncured claim is treated as Cash Payment B |
| Cash Payment B: Pro Rata Cash | estimated to be $75 | no documents needed; adjusts up or down with the number of valid claims |
| Credit Monitoring | 2 years of CyEx Medical Shield Complete | includes dark web monitoring and up to $1,000,000 identity theft insurance; the FAQ says all class members get it automatically with the code on their postcard, no claim needed |
| Security enhancements | not a cash benefit | security improvements the defendants have made or will make |
An amount marked estimated or pro rata changes with the number of valid claims: more claims, smaller shares. Losses need proof, such as receipts or bank statements.
Deadline and payout
- Claim deadline: . Online by 11:59 p.m. ET or mailed postmarked by December 30, 2026.
- Opt-out and objection deadline: .
Payout. Benefits will be distributed after final approval and any appeals are resolved; no hearing or payment date is published yet.
The administrator: “a payment estimated to be $75.”
How to file
- Go to covenanthealthdatasettlement.com (the only authorized Settlement Website) and choose Submit Claim.
- Choose Cash Payment A (documented losses up to $5,000, with proof) and/or Cash Payment B (estimated $75, no proof).
- Or mail a paper Claim Form to Kroll at P.O. Box 225391, New York, NY 10150-5391, postmarked by December 30, 2026.
- Keep the postcard: its unique code turns on the two years of credit monitoring after final approval.
Official site: covenanthealthdatasettlement.com. Phone: (833) 453-2423. Mail: In re: Covenant Health Data Security Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391.
The breach, and what to do today
On or around May 18, 2025, an unauthorized actor got into the IT environment of Covenant Health Inc., the health system whose facilities include St. Joseph Hospital and St. Joseph Hospital Nashua, N.H. (the case is in Penobscot County, Maine), and patients' personal and health information may have been compromised. Covenant Health began notifying patients on or around July 11, 2025.
What was exposed: names; addresses; dates of birth; medical record numbers; Social Security numbers; treatment information (diagnoses, dates and type of treatment); health insurance information.
A settlement pays for what already happened. The data is still out there, so do these now:
- Freeze your credit.In the US it’s free at Equifax, Experian and TransUnion, and no one can open credit in your name while it’s on. Lift it for a day when you apply for credit yourself.
- Get an IRS Identity Protection PIN.It stops anyone filing a tax return in your name with your Social Security number. Request one at irs.gov/ippin.
- Read your health insurance statements.Check each Explanation of Benefits for care you never had, and tell your insurer if you find any. Medical records can’t be changed like a password.
- Distrust messages about Covenant Health and this settlement.Breach data is used to make scam messages personal enough to believe, for years afterwards. Go to the company or the official site yourself.
To see which other breaches your email address is in, search it on Have I Been Pwned, then read Breaches.
Not published yet
The administrator and the court had not published these when HARD checked on 8 November 2026, so this page doesn’t guess:
- When payments will be sent.
- How many people are in the settlement.
Questions
Is the Covenant Health data breach settlement legit?
Yes. It is In re: Covenant Health Data Security Litigation, case PENSC-CV-2025-63, in the Superior Court of Penobscot County, Maine. Kroll Settlement Administration runs it for the court, and the only official site is covenanthealthdatasettlement.com.
Who qualifies for the Covenant Health settlement?
All persons residing in the United States whose Private Information was compromised by the May 2025 Data Incident and who were sent notice of it. Patients of any Covenant Health facility may be included. Excludes the defendants' directors and officers, the judges and their families and court staff, and anyone who opts out.
How much will I get from the Covenant Health settlement?
Up to up to $5,000 for losses you can prove, or estimated to be $75 as a cash payment without receipts. The total settlement is $2,000,000. Final amounts depend on how many valid claims there are.
What is the deadline for the Covenant Health settlement?
File by 30 December 2026, on covenanthealthdatasettlement.com or by mail.
When will the Covenant Health settlement pay out?
Benefits will be distributed after final approval and any appeals are resolved; no hearing or payment date is published yet.
Other settlements: California Casualty, Finastra, Telmate, AMCA, DaVita, Warner Music Group, and the rest in Settlements.
Sources
Checked on 8 November 2026. HARD is not part of the case and doesn’t take claims.
- In re: Covenant Health Data Security Litigation: settlement home and important dates, Kroll Settlement Administration LLC, read 7 Nov 2026: fund, benefits, opt-out, objection and claim deadlines, hearing not yet set.
- Frequently Asked Questions, Kroll Settlement Administration LLC, read 7 Nov 2026: case number, data list, July 11 2025 notification, benefits, postcard code, fees, contact.