Maine health system confirms data breach impacted 145K as civil litigation moves forward
Editor's Note (1/22/25): This story has been updated with new information about pending litigation.
A nonprofit integrated healthcare system in Maine said it’s completed notifying patients impacted by a data breach it discovered in summer 2025. The incident impacted over 145,000 people.
In an announcement, Central Maine Healthcare confirmed it completed all notifications just prior to the new year—a process it said began on July 31, 2025. An investigation into the scope of the breach did not conclude until November, some five months after it was discovered.
The process may have been complicated by the length of time the hackers had access to the network of the three hospitals and dozens of care centers. According to Central Maine, the “unauthorized party” gained access to systems as early as March 19, 2025, lurking unnoticed for months.
The organization said it worked with a third-party cybersecurity company to identify the vector and map the scope of the attack. Details such as the method hackers used and if there was any communication between hospital officials and the criminals were not revealed.
The statement did say, however, that as soon as staff at Central Maine became aware of an intruder inside its “information technology network,” leadership immediately “took steps to protect and secure” systems, while also notifying law enforcement.
Compromised data include sensitive information on patients. Details such as names, dates of birth, Social Security numbers were all accessed or stolen by hackers, as was information on delivered treatments, dates of service, provider names and health insurance numbers.
The specific number of victims was not reported to the Maine Attorney General until last week, with it revealed to be 145,381.
According to the notice to the state government, written notifications were sent out twice in August, and then again in December, to everyone known to be affected.
Central Maine said it is offering credit monitoring and identity theft protection services to concerned parties, as required by federal law.
Civil litigation ramping up
Shortly after the Maine government reported details on the cybersecurity incident, Murphy Law Firm announced it’s “investigating claims on behalf of all individuals whose personal and confidential information was compromised in the data breach.”
The group followed up by inviting patients to sign up for a pending class action lawsuit, specifically those who received notice that they were victims of the cybersecurity event.
“We are evaluating legal options, including a potential class action lawsuit, to recover damages for individuals who were affected by the Central Maine Healthcare data breach,” Murphy Law wrote.
In an email to HealthExec, a spokesperson with Milberg, one of the nation's largest class action law firms, confirmed that litigation has already been filed and is moving forward:
"Our firm and one [other] actually filed two class action complaints related to this data breach last year. Those cases were consolidated in Maine state court last year, and our firm was appointed sole lead by the court," the spokesperson wrote.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.