AdaptHealth

Summary

AdaptHealth disclosed that a cyberattack exposed the data of 4,115,802 individuals after a threat actor used social engineering to compromise a privileged third-party contractor account and access cloud-based business applications, including patient management, document storage, and electronic health record portals. Exfiltrated information included names, contact and demographic details, health information, and health insurance information; the company reported no impact to Social Security numbers or financial information and no evidence of identity theft, fraud, or other misuse.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

AdaptHealth, a healthcare company that provides home medical devices, supplies, and related services, experienced a cyberattack involving unauthorized access to cloud-based business applications. The company’s services include sleep-apnea and respiratory equipment, oxygen therapy, hospital beds, mobility products, and other medical equipment. AdaptHealth operates a network of more than 680 facilities across the United States and served about 4.1 million patients across all 50 states as of July 2024. The compromise occurred on June 5, 2026, when a threat actor gained access to systems through a successful social engineering ploy that compromised the privileged account of a third-party contractor. The accessed environment included certain internal patient management systems, document storage platforms, and electronic health record system portals. On June 15, an unnamed threat actor contacted AdaptHealth and demanded a ransom payment in exchange for not leaking the stolen data.

AdaptHealth first disclosed the incident in a filing with the U.S. Securities and Exchange Commission on July 2, 2026, stating that attackers had accessed its systems and exfiltrated private data. The company later provided an update on August 14 describing the categories of information involved in the incident. The exposed data may have included full names, contact information, demographic information, health insurance information, and health information. AdaptHealth stated that Social Security numbers and financial information were not affected. The company also said it had found no evidence of identity theft, fraud, or other misuse of the data stolen in the attack. The breach was attributed in reporting to the ShinyHunters threat group, although BleepingComputer stated it could not find an AdaptHealth entry on ShinyHunters’ extortion portal.

The incident affected 4,115,802 individuals, according to AdaptHealth’s submission to the U.S. Department of Health and Human Services. HHS added AdaptHealth to its data breach portal in the week of September 10, 2026. AdaptHealth notified individuals impacted by the breach and provided instructions for enrolling in a free 12-month credit monitoring and identity protection service. The company’s investigation confirmed that the intrusion involved cloud-based applications used for patient management, document storage, and electronic health record-related access. The breach involved the theft of personal, health, and insurance information, including a password file associated with insurance billing. AdaptHealth’s public disclosures described the event as a cyberattack that led to data exfiltration after the attacker compromised a third-party contractor’s privileged account through social engineering.

Sources

Sources available to members: 2 sources.