.png)
Patients and other individuals whose private information the Covenant Health Inc. data breach that occurred on May 18, 2025, may have compromised could be eligible to claim up to $5,000, as well as credit monitoring, from a class action settlement.
Covenant Health, along with St. Joseph Healthcare Foundation, St. Joseph Hospital and St. Joseph Hospital Nashua, New Hampshire, agreed to pay $2 million to settle a class action lawsuit. The lawsuit alleged the defendants failed to adequately protect patients’ personally identifiable information and private health information following a ransomeware attack in May 2025. The compromised information included names, addresses, dates of birth, Social Security numbers, medical record numbers, health insurance information, dates of treatment, diagnoses and specific treatment details.
Who can file a claim?
Class members are individuals who reside in the United States, whose private information the May 18, 2025, data incident involving Covenant Health compromised and who received a notice from Covenant Health informing them the data breach affected their information.
How much can class members get?
Class members can choose one of two types of cash payments plus credit monitoring:
- Cash payment A – Documented losses: Up to $5,000 for documented, unreimbursed losses and expenses incurred as a result of the data incident.
- Cash payment B – Pro rata cash: An estimated $75 cash payment subject to pro rata adjustment depending on the number of valid claims
- Credit monitoring: Two years of CyEx Medical Shield Complete, which includes credit monitoring, dark web monitoring, real-time alerts, lost wallet protection and up to $1 million in identity theft insurance
If the number of valid claims exceeds the available funds, the settlement administrator will reduce cash payments proportionally to ensure claims do not exceed the fund. It will donate any residual funds after all payments to a nonprofit organization the court approves.
How to claim a class action payment
To receive a cash payment, class members must submit an online claim form or print and complete the PDF claim form.pdf) and mail it to the settlement administrator.
Settlement administrator's mailing address: In re: Covenant Health Data Security Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391
The deadline to file a claim is Dec. 30, 2026.
What proof or documentation is required to submit a claim?
- Cash payment A – Documented losses: Claimants must provide third-party documentation, such as receipts, invoices, credit card statements or phone bills that demonstrates the losses' relationship to the data incident. Self-prepared documents alone are not sufficient, but class members may use them to supplement other evidence.
- Cash payment B – Pro rata cash: No documentation is required. Class members simply need to select this option on the claim form.
- Credit monitoring: No documentation is required.
- Online claim form: Class members using the online claim form must supply the class member ID they received in their settlement notice.
Payout options
- Zelle
- Venmo
- PayPal
- ACH (direct deposit)
- Physical check mailed to the address on file
$2 million settlement fund breakdown
The $2,000,000 settlement fund includes:
- Settlement administration costs: Amount not specified
- Attorneys' fees: Up to $666,667
- Attorneys' expenses: Amount not specified
- Service awards to class representatives: $2,500 each ($27,500 total)
- Credit monitoring costs: Dependent on number of valid claims for this option
- Payments to eligible class members: Remainder of the settlement fund
Important dates
- Deadline to opt out: Dec. 15, 2026
- Deadline to file a claim: Dec. 30, 2026
- Final approval hearing: Date not yet set
When is the Covenant Health settlement payout date?
The settlement administrator will distribute payments and credit monitoring activation codes to eligible class members after the court resolves any appeals and grants final approval of the settlement.
Why is there a class action settlement?
An unauthorized actor allegedly accessed Covenant Health's IT environment on May 18, 2025, potentially compromising patients’ personal and health information. The plaintiffs claimed Covenant Health failed to adequately protect this sensitive data.
The defendants denied all allegations of wrongdoing but agreed to settle to avoid the cost and uncertainty of litigation.
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.svg)