Central Maine Healthcare data breach: what happened and what to do

Someone had access to Central Maine Healthcare's network from March 19 to June 1, 2025. The Maine Attorney General lists 145,381 people affected. Files held names, dates of birth, treatment and insurance details, and Social Security numbers for some patients.

View all 13,177 breaches

Breach date: 19 Mar 2025
Made public: 31 Jul 2025
Affected: 145,381
Data exposed: Names, Dates of birth, Treatment information, Health insurance information, Social security numbers
Last updated: 24 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Central Maine Healthcare says it found unusual activity on its network on June 1, 2025. Its investigation concluded that an unauthorized party had been in its systems from March 19, 2025 until that date.

What was exposed

The health system's notice says affected files may have held names, dates of birth, treatment information, dates of service, provider names and health insurance information. For some patients the files also held Social Security numbers.

That mix matters. A date of birth plus a Social Security number is what criminals need to open credit in someone else's name. Insurance and treatment details can be used for medical identity theft, or to make a phishing message sound like it really comes from your hospital or plan.

What the company did

Letters went out in waves between July 31, 2025 and December 29, 2025. The Maine Attorney General's breach listing shows 145,381 people affected in total, 138,800 of them Maine residents. Central Maine Healthcare offered single-bureau credit monitoring, a credit report and a credit score service, and set up a toll-free response line at 833-397-7918. Other sources report different totals, so treat 145,381 as the figure on the state filing.

A class action over the incident has been consolidated as In re Central Maine Data Security Litigation.

Sources checked: cmhc.org, hipaajournal.com, maine.gov

Last verified against the official page: 24 Oct 2026

How we research this Report an error

What to do if you were in it

1

Read your insurance and provider statements

Check every explanation of benefits and bill for services you didn't receive. If you see one, call the provider or health plan right away, as the notice advises.
2

Freeze your credit

A credit freeze is free and stops new accounts being opened in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how at https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts.
3

Expect phishing that mentions your care

Messages that cite your hospital, plan or the breach can be scams. Don't click links or give details to anyone who contacts you first; call the number on your card or statement.
4

Use the monitoring on offer

If you got a letter, use the credit monitoring it includes, and call the response line (833-397-7918) if you have questions. If you think your identity was misused, report it at https://www.identitytheft.gov/.
5

Check whether your email or phone is in other breaches

Run a free scan at https://www.serus.ai to see where your email or phone number has turned up.

Official filings

U.S. Department of Health and Human Services , filed 31 Jul 2025 : 7,223 people

Timeline

19 Mar 2025
The breach happened
31 Jul 2025
The company made it public
31 Jul 2025
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Central Maine Healthcare breach?

If you were a patient, you should have received a letter between July 31 and December 29, 2025. If you didn't get one and think you should have, call the company's response line at 833-397-7918.

Were Social Security numbers exposed?

For some patients, yes. The company's notice says files may have contained Social Security numbers for some people. Other data included names, dates of birth, treatment and insurance information.

Is there a settlement?

A class action was consolidated as In re Central Maine Data Security Litigation. Check the court's settlement notice and the company's site for current terms and deadlines.