Covenant Health Notifying 480K Patients of 2025 Data Theft

Nearly half a million patients of a Catholic healthcare network that serves New England and parts of Pennsylvania began the new year by receiving notifications that hackers may have stolen their health information in a May 2025 hacking incident.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Ransomware gang Qilin claimed responsibility last spring for an attack against the Massachusetts-based Covenant Health. The health network said Dec. 31 the breach affected 478,188 individuals. Covenant had reported the incident to federal regulators in July as affecting only about 7,900 individuals.

Covenant last May disclosed it was dealing with an incident disrupting IT systems at several clinics, hospitals and other facilities (see: Covenant Health Dealing with Cyberattack Affecting Hospitals).

Covenant said it became aware on May 26 of “irregularities impacting connectivity across the organization.” In response to contain the incident, Covenant said it immediately discontinued access to all data systems in its hospitals, clinics and provider practices. Qilin claimed to have stolen 852 gigabytes of data, although Covenant does not appear as of Monday to be listed on the group’s leak site.

Ransomware monitoring site, Ransomware.live, earlier captured screenshots of Qilin’s listing of Covenant.

Information potentially affected included patient name, address, date of birth, medical record number, Social Security number, health insurance information and treatment information, such as diagnoses, dates of treatment and type of treatment.

Since the incident, Covenant said it has “enhanced” the security of its IT environment to help prevent similar future data security incidents.

Covenant did not immediately respond to Information Security Media Group’s request for additional details about the incident, including comment on Qilin’s claims.

Russian-speaking ransomware gang Qilin has been implicated in a long and growing list of attacks on healthcare sector entities in the United States and across the globe.

Qilin was behind a highly disruptive – and dangerous – 2024 attack against British pathology services firm Synnovis, forcing the National Health Service in England to cancel and reschedule thousands of appointments and procedures at NHS trusts – London’s King’s College Hospital and Guy’s and St. Thomas hospitals (see: Synnovis Notifying UK Providers of Data Theft in 2024 Attack).

That attack led to shortages of O-negative type blood in the United Kingdom for several months afterward because of reduced collections that caused stocks of blood to drop to unprecedentedly low levels (see: NHS: Blood Supply Still Affected by June 2024 Vendor Attack).