On or about June 1, 2025, Central Maine Healthcare (“CMH”) detected unusual activity within its information technology (IT) network. The organization immediately secured its systems, launched an internal investigation, and notified law enforcement. Following a comprehensive forensic review completed on November 6, 2025, CMH determined that an unauthorized party accessed its network between March 19, 2025, and June 1, 2025, and may have acquired files containing sensitive personal information.
On December 29, 2025, CMH issued notices to impacted individuals and began offering complimentary credit monitoring services to those whose Social Security numbers or driver’s license numbers were potentially exposed.
Central Maine Healthcare operates hospitals, clinics, and specialty care centers across Maine, providing medical services to 400,000 individuals and supporting thousands of employees.
The compromised data included information relating to patients as well as current and former employees.
Following the breach, CMH implemented enhanced monitoring and alerting software to strengthen its security posture and reduce the risk of similar incidents in the future.
If you received a Data Breach notification letter from Central Maine Healthcare, it confirms that your information was potentially accessed and/or acquired during the incident.
What information is involved in the Central Maine Healthcare Inc. Data Breach?
Compromised information may include:
First Name
Last Name
Social Security Number
Your Personally Identifiable Information (PII) includes sensitive details that can be used to identify you. Organizations are legally required to safeguard this information, and failure to do so can result in legal consequences. When PII is stolen, it may be exploited by criminals to commit identity theft or fraud.
A subset of PII — Protected Health Information (PHI) — includes medical and health‑related data. PHI is protected under federal and state laws, and healthcare providers are required to ensure its security. If compromised, PHI can be misused alongside PII to commit more extensive identity‑related fraud.
If your data has been exposed in a breach, enrolling promptly in credit and identity monitoring services is one of the most effective steps you can take. Central Main Healthcare, Inc. advises affected patients to stay alert, monitor financial and insurance statements closely, and consider placing fraud alerts or security freezes with major credit bureaus.
California residents benefit from additional privacy protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights related to personal data. California also enforces the Confidentiality of Medical Information Act (CMIA), which imposes strict safeguards for medical information.
If you received a NOTICE OF DATA BREACH letter from Central Maine Healthcare, Inc., your personal and/or medical information may be at risk. This type of sensitive data can be misused by identity thieves to commit fraud and other crimes.
Contact the Data Breach Lawyers at Emery | Reddy, PC for a Free Case Review today.