Covenant Health data breach settlement

Who may be eligible

Covenant Health and the St. Joseph hospitals in New Hampshire have agreed to a $2,000,000 settlement over a ransomware attack on or around May 18, 2025 that reached patient records. If you were sent a notice about that incident you may be eligible to choose a pro rata cash payment the notice estimates at about $75, which needs no documents, or reimbursement of documented losses up to $5,000; two years of CyEx Medical Shield Complete monitoring goes to class members with no claim form at all. Claim forms are due by December 30, 2026, and the deadline to opt out or object is December 15, 2026. The $75 is an estimate that falls if more valid claims arrive, and filing on the official settlement site is free.

The eligibility period on the official materials is From May 18, 2025. The notice states no state limit, so it is usually nationwide. Covered: Covenant Health, St. Joseph Hospital, St. Joseph Hospital Nashua, St. Joseph Healthcare Foundation.

Only the official administrator or agency decides who is eligible. Read the official notice before filing, and file only if you believe you meet its criteria.

How much it may pay

About $75. Every figure here is an estimate from public materials, not a guarantee: many settlements pay pro rata or only after a claims review, so final amounts commonly land well below the advertised maximum.

Cash Payment B is a pro rata share the notice estimates at about $75 and needs no documents — the claim form only has to elect it. Cash Payment A reimburses documented losses up to $5,000 and needs third-party records such as receipts, invoices or statements. Two years of CyEx Medical Shield Complete monitoring goes to class members without a claim form once the settlement is finally approved. Every figure here is an estimate from a $2,000,000 fund, and the pro rata amount falls if more valid claims arrive. Filing on the official site is free.

What the deadline is

The claim deadline is December 30, 2026.

The deadline to opt out or object is December 15, 2026.

The settlement site says the court has not yet set a final approval hearing and will update the site when it does. Payments follow final approval and any appeals, so timing can move.

What proof is needed

No proof mentioned for the basic option.

The basic claim usually asks for your name, contact details and a statement that you meet the criteria. Optional higher tiers, such as documented losses, can still require records.

How to file for free

Open the official claim page on this page, run by Kroll Settlement Administration LLC, read the criteria, and file there if you believe you meet them. Filing is free: official claims never carry a fee, and this site never files on anyone's behalf.

Never give a Social Security number, bank login or card number to a site that is not the official administrator or agency page.

Why this case happened

The case consolidates claims over a ransomware attack on or around May 18, 2025 that reached patient records held by Covenant Health and the St. Joseph hospitals in New Hampshire. Reported notice letters named information including names, addresses, dates of birth, Social Security numbers, medical record numbers, insurance details, treatment dates and diagnoses. The defendants deny the allegations. The postcard notice carried a unique code used to switch on the credit monitoring benefit; the cash claim form does not ask for it.