Covenant Health sued after data breach put over 478,000 patients at risk of identity theft

Covenant Health class action overview:

• Who: Plaintiff Michael Wickett filed a class action lawsuit against Covenant Health Inc.
• Why: Wickett claims Covenant Health failed to protect the personal information of patients during a data breach.
• Where: The Covenant Health class action lawsuit was filed in Massachusetts federal court.

A new class action lawsuit alleges that Covenant Health failed to adequately protect the personal information of patients during a data breach that exposed the data of more than 478,000 individuals.

Plaintiff Michael Wickett filed the class action complaint against Covenant Health on Jan. 6 in Massachusetts federal court, alleging violations of state and federal consumer laws.

Covenant Health is a Catholic health care organization based in New England and Pennsylvania. Wickett and other class members are current and former patients of Covenant Health who were required to provide their personally identifiable information (PII) and protected health information (PHI) to receive healthcare services.

The class action lawsuit claims that on or around May 18, 2025, an unauthorized actor gained access to Covenant Health’s network and computer systems, compromising the PII and PHI of patients. 

The types of information exposed in the data breach include names, addresses, dates of birth, Social Security numbers, health insurance information, medical record numbers and treatment information.

Covenant Health failed to implement reasonable safeguards, lawsuit alleges

Wickett claims that Covenant Health had numerous statutory, regulatory, contractual and common law duties to keep patients’ private information confidential, safe, secure and protected from unauthorized disclosure or access.

However, the Covenant Health class action lawsuit alleges the organization breached these duties by failing to implement and maintain reasonable safeguards; failing to comply with industry-standard data security practices and federal and state laws and regulations governing data security; and failing to properly train its employees on data security measures and protocols.

As a result of the data breach, Wickett and the class members now face a present and imminent lifetime risk of identity theft or fraud, the lawsuit says.

The Covenant Health class action lawsuit seeks to represent all persons residing in the United States whose private information was compromised during the data breach.

Wickett is suing for negligence, unjust enrichment, breach of implied contract, breach of fiduciary duty and breach of the implied covenant of good faith and fair dealing. He seeks certification of the class action, damages, fees, costs and a jury trial.

Meanwhile, Continuum Health Alliance and Consensus Medical Group have agreed to a class action settlement to resolve claims that they failed to prevent a 2023 data breach.

What do you think of the allegations made in this Covenant Health data breach lawsuit? Let us know in the comments.

The plaintiff is represented by Christina Xenides Tyler J. Bean and Kennedy M. Brian of Siri & Glimstad LLP and Bryan Bleichner and Philip J. Krzeski of Chestnut Cambronne P.A.

The Covenant Health data breach class action lawsuit is Wickett v. Covenant Health Inc., Case No. 1:26-cv-10044, in the U.S. District Court for the District of Massachusetts.

Read About More Class Action Lawsuits & Class Action Settlements:

• AT&T class action alleges business customers billed for disconnected services
• Class action claims Celestial Seasonings teas contain artificial flavor despite natural claims
• Diva Fam recalls True Sea Moss Gel Superfood due to botulism risk
• Volkswagen recalls over 356,000 Audi vehicles due to faulty rearview cameras