A data breach involving patients at Covenant Health, the parent company of St. Mary’s Health System in Lewiston, was much bigger than initially reported, officials said this week.

The Massachusetts-based health system originally reported to the Office of the Maine Attorney General that a cybersecurity incident in May had impacted the information of about 8,000 people.

On Wednesday, Covenant Health updated the number to include more than 478,000 patients, including nearly 285,000 Maine residents.

The information accessed by an unauthorized party in May includes patients’ names, Social Security numbers, addresses and treatment details. Covenant Health has investigated the extent of the breach since it occurred, said Karen Sullivan, spokesperson for the health system.

“On December 10, 2025, through its ongoing extensive data analysis, Covenant Health and third-party forensic specialists determined that additional patient information may have been involved in a data security incident that occurred earlier this year,” the company said in a statement provided by Sullivan.

The health system, which also owns St. Joseph Healthcare in Bangor and health care facilities in six states, began notifying patients this week.

On May 26, Covenant Health was alerted to unusual activity in its information technology network. Officials determined that an unauthorized party had breached its systems more than a week earlier.

Covenant Health officials said they quickly worked to secure and restore systems.

Patients were notified in July after an initial review of the breach found that about 4,600 Maine residents had been impacted. This week, the same notification letter went out to hundreds of thousands more patients, offering free identity protection services and vowing to protect patient data against future incidents.

“Covenant Health takes the security of patient data seriously and regrets this incident,” Sullivan said. “We have implemented additional administrative and technical safeguards to further secure our environment and help prevent something like this from happening again.”

Covenant officials did not elaborate on why or how its initial review vastly underestimated the number of patients affected.

Central Maine Healthcare, which operates Central Maine Medical Center in Lewiston and hospitals in Bridgton and Rumford, reported a similar cyber incident on June 1 and shut down its systems. The health system’s IT network was breached by an unauthorized party that accessed patient names and Social Security numbers.

Because of the breach, patients from both health systems were left waiting on test results, appointments and medication refills.

Experts say these kinds of attacks have been on the rise for years nationwide. Between January 2018 and September 2023, there was a 239% increase in health care data breaches reported to the U.S. Department of Health and Human Services, according to the HIPAA Journal, which analyzes data breach statistics.

While 2023 broke records for the most reported data breaches and the most breached records, 2024 saw the highest number of individuals affected by health care breaches. Breaches seem to have decreased in 2025, pending additional data that appears to be backlogged because of the government shutdown.

Covenant Health is urging patients who believe their information was involved in the breach or have questions to call 855-361-0344.

It is also urging those whose information may have been involved in the incident to review bills and statements received from their health care providers and health insurance plans, and to immediately contact the provider or plan if they see services they did not receive.