A data breach at Central Maine Healthcare impacted about 145,000 more patients than the eight initially reported, officials said Monday.

The health system, which owns Central Maine Medical Center in Lewiston as well as hospitals in Bridgton and Rumford and several other health care facilities, reported to the Office of the Maine Attorney General last summer that a cyberattack between March and June had impacted only eight patients.

On Monday, officials reported that the number was 145,381 patients, including 138,880 Maine residents.

Jim Cyr, spokesperson for Central Maine Healthcare, said Tuesday that the initial number only reflected the beginning of the investigation.

“Our immediate focus was to secure systems and protect patient data,” Cyr said. “In parallel, we worked diligently to review the data involved in the incident and notified individuals and regulators in phases while we completed our analysis.”

Early this month, Central Maine Healthcare patients received letters alerting them that their names and Social Security numbers may have been accessed by an unauthorized party during a data breach that lasted from March 19 until it was discovered in June.

Analysis of the incident was completed Nov. 6, the letters states.

The notice comes weeks after Covenant Health, a multi-state health system that owns St. Mary’s hospital in Lewiston, underestimated the scope of a May cyber incident. It filed a report last summer stating about 8,000 people were impacted; a Dec. 31 update adjusted that number to more than 478,000 patients.

The breaches at the two hospital systems left patients waiting for care and struggling to contact providers.

It’s unclear whether the two incidents are connected. Covenant Health owns hospitals in six states, but the breach impacted mostly Maine residents. Central Maine Healthcare only owns facilities in Maine, but more than 6,000 patients impacted were not state residents. A spokesperson for the Maine AG’s office said they cannot comment on investigations.

The office did not respond to follow-up questions asking broadly why two reports about the same cyber incident would record significantly different numbers.

It’s no coincidence that health systems are being targeted. Between January 2018 and September 2023, there was a 239% increase in health care data breaches reported to the U.S. Department of Health and Human Services, according to the HIPAA Journal, which analyzes data breach statistics.

Central Maine Healthcare is urging patients with questions about the incident to call 1-833-397-7918. Patients who believe their personal information has been misused should immediately contact the Federal Trade Commission or Attorney General’s office.