AdaptHealth Data Breach Affects 4.1 Million Individuals
In early July, we reported that AdaptHealth had notified the U.S. Securities and Exchange Commission that it had experienced a cybersecurity incident involving the theft of patient data. At the time of the Form 8-K filing, AdaptHealth had not determined the extent to which patient data was compromised in the incident. The HHS Office for Civil Rights has now been informed that the electronic protected health information of 4,115,802 individuals was compromised in the incident.
AdaptHealth added a notice to its website on August 14, 2026, that provided further information on the data compromised in the incident. The notice explains that the forensic investigation determined that the attack occurred on June 5, 2026, and the threat actor exfiltrated files containing names, contact information, demographic information, health insurance information, and health information. AdaptHealth explained that it is unaware of any actual or attempted misuse of that data; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months. There is currently no listing on the ShinyHunters data leak site, which suggests that the entry has been removed.
July 3, 2026: AdaptHealth Reports Material Cybersecurity Incident and Theft of Patient Data
AdaptHealth, a publicly traded healthcare company that provides home medical equipment, diabetes supplies, and sleep therapy products, has informed the U.S. Securities and Exchange Commission (SEC) that it is investigating a material cybersecurity incident involving unauthorized access to patient data.
According to the company’s Form 8-K filing, a threat actor contacted the company on June 15, 2026, claiming to have obtained files containing patient data. AdaptHealth launched an investigation, engaged third-party cybersecurity experts, and notified law enforcement. AdaptHealth has determined that certain cloud-based business applications were accessed by the threat actor, including internal patient management systems and document storage platforms. Files containing patients’ personally identifiable information (PII) and protected health information were exfiltrated by the threat actor.
The investigation is ongoing; however, AdaptHealth has determined that the unauthorized access occurred as a result of a response to a social engineering attack on a third-party contractor, which allowed the contractor’s credentials to be obtained. The threat actor obtained a stored password file tied to insurance billing and access to external electronic health record portals.
The affected account has been disabled, credentials have been reset, and additional access controls have been implemented. The incident has not had an impact on its operations or patient services, and a review is ongoing to determine the extent of data theft. The types of data involved have yet to be determined, and the number of affected individuals is currently unknown. AdaptHealth said it does not collect patients’ Social Security numbers, and financial account information and payment card information are not stored in the compromised systems.
AdaptHealth said it considers this to be a material cybersecurity incident due to the nature and potential volume of data at risk. The financial impact of the incident is still being assessed, with the company potentially having to cover costs associated with forensics, breach notification, legal and regulatory responses, and any remediation measures. The company holds a cybersecurity insurance policy, which may cover certain losses associated with the incident.
While AdaptHealth has not named the threat actor behind the attack, this appears to have been a data theft and extortion attempt by the ShinyHunters threat group. ShinyHunters added AdaptHealth to its data leak site and has threatened to leak the stolen data if the ransom is not paid, giving the company a final warning to pay or face a data leak.
