Article
What happened
Covenant Health, based in Andover, Mass., operates three hospitals and related facilities across six states. Attackers had access to its network from May 18 to about May 26, 2025. The Qilin ransomware group later claimed responsibility and said it had taken more than 1.3 million files. It has since posted data it says came from Covenant, which suggests no ransom was paid.
The attack affected care at St. Joseph Hospital and St. Mary’s Health System in Maine and St. Joseph Hospital in New Hampshire. Wait times rose at St. Mary’s and its labs could only take paper orders, while lab services in New Hampshire were limited to the main campus.
In July the system told Maine’s attorney general that about 7,800 people were affected. After its investigation closed Dec. 10, an updated filing on Dec. 31 put the total at 478,188. Exposed data includes names, addresses, birth dates, Social Security numbers, medical record numbers, insurance details and treatment information. Notification letters began going out Dec. 31 with a year of credit monitoring.
Why the number moved so much
Early counts in ransomware cases usually reflect only the records investigators can confirm at that point. Full forensic review of exfiltrated files often takes months, especially when the stolen data is unstructured documents rather than database tables. The gap between the first and final figures is a reporting risk in its own right, because it shapes regulatory scrutiny, litigation exposure and public trust.
Qilin was one of the most active ransomware operations of 2025, and health care remains a frequent target. Executives should assume similar timelines will apply to their own incidents.
Questions boards should ask now
- How will we describe an early estimate? Public statements and regulatory filings should say clearly that initial counts are provisional.
- How fast can we review stolen files? Confirm that forensic and data-mining vendors are under contract before an incident, with defined turnaround times.
- Can labs, pharmacy and imaging run on paper? Downtime procedures should be tested, not just written.
- Do we know where sensitive data sits? Reducing copies of Social Security numbers and clinical documents on file shares limits what attackers can take.
- Is our insurance aligned with a late, larger count? Check how cyber coverage treats notification and monitoring costs that grow months after the event.
Archive entry for Jan 6, 2026, added Nov. 11, 2026.