- CMH breach exposed PII of 145,381 patients and employees in March 2025
- Stolen data includes names, SSNs, health insurance, and treatment information
- No actors claimed responsibility; victims offered credit monitoring and support services
The recent data breach at Central Maine Healthcare (CMH) has compromised the personally identifiable information (PII) of over 145,000 individuals, following a cyberattack that occurred in late March 2025 and was detected in June 2025.
In a notification letter sent to affected individuals, CMH confirmed the breach, revealing that an investigation concluded on November 6, 2025, identifying exactly 145,381 individuals whose sensitive data was accessed.
Data Yet to Surface
The compromised information includes names, dates of birth, treatment details, service dates, provider names, health insurance information, and Social Security numbers (SSNs). Both patients and employees were impacted by this incident.
CMH advises those affected to carefully review statements from their healthcare providers and health insurance plans. If they notice any discrepancies, they should contact their provider or health plan immediately.
As part of their response, CMH is offering free credit and identity theft monitoring services, along with a dedicated support line for victims to report concerns and seek assistance.
As of now, no individuals or groups have claimed responsibility for the breach, and the stolen data has not appeared on the dark web. It is likely that criminals will use this information for phishing attacks or sell it to other parties.
Central Maine Healthcare is a nonprofit health care system serving approximately 400,000 residents in central, western, and mid-coast Maine. It operates three hospitals and a comprehensive network of primary and specialty care providers.
Via BleepingComputer