Central Maine Healthcare has agreed to pay more than $1.3 million to settle a class action lawsuit over an extended data breach last year.

The cyberattack impacted more than 450,000 patients of the health care corporation, which owns Central Maine Medical Center in Lewiston, hospitals in Bridgton and Rumford, and several other health facilities. An unauthorized party gained access to the health system’s IT network in March 2025 until it was discovered in June.

The outside entity may have accessed and acquired private health information such as patient names, birth dates, Social Security numbers, treatment information and diagnostic information.

The settlement, finalized July 1, comes after six class action lawsuits were filed last year on behalf of individuals impacted by the data incident. They were consolidated into one case, and after months of mediation, officials of Central Maine Healthcare and Central Maine Medical Center agreed to settle the lawsuit by paying more than $1.3 million toward a cash fund, without admitting liability or wrongdoing.

Patients who can document losses traceable to the incident can submit a claim to receive up to $5,000 in cash, or $50 without providing documentation, according to the Central Maine Data Security Litigation website. Patients can also apply to receive one year of free medical records monitoring.

Claims must be submitted or postmarked by Sept. 28.

A hearing Oct. 28 at 9 a.m. at the Androscoggin County Superior Court will determine whether the court grants final approval to the settlement.

Settlement notification letters have been mailed to Central Maine Healthcare patients.

Multiple lawsuits were also filed in 2025 against Covenant Health, a multi-state health system that owns St. Mary’s Health System in Lewiston and St. Joseph Healthcare in Bangor, after a May cyber incident impacted more than 478,000 patients, including nearly 285,000 Maine residents.