AdaptHealth reports material breach of patient data after social-engineering attack

On 2 July 2026, AdaptHealth — one of the largest U.S. providers of home medical equipment and supplies, headquartered in Plymouth Meeting, Pennsylvania — disclosed a material cybersecurity incident in a filing with the U.S. Securities and Exchange Commission, confirming that a threat actor had reached internal systems holding patient personal and health information. The company said the intrusion began with a social-engineering attack on a third-party contractor, whose credentials were then used to enter AdaptHealth's cloud environment.

According to the company, it first learned something was wrong on 15 June 2026, when a threat actor contacted AdaptHealth claiming to have obtained certain data from its systems. AdaptHealth activated its incident response procedures, engaged external cybersecurity advisers, and notified law enforcement. On 27 June 2026, the company determined that the incident was material given the nature and potential volume of the data at risk, and it filed a Form 8-K disclosing the matter in early July.

What was accessed

AdaptHealth said the attacker gained unauthorised access to several of its cloud-based business applications, including certain internal patient management systems and document storage platforms, and confirmed that external electronic health record system portals were accessed. The data implicated includes passwords associated with insurance billing along with personally identifiable information and protected health information of patients. The company cautioned that the full scope of the affected data sets had not yet been determined and that it could not yet quantify the volume of data involved.

Threat actor

AdaptHealth did not name an attacker in its regulatory filing. Subsequent reporting indicated that the data-theft and extortion group ShinyHunters had added AdaptHealth to its leak site and threatened to publish the stolen data unless a ransom was paid — a claim consistent with the group's 2026 pattern of extortion against large enterprises, though AdaptHealth has not publicly confirmed the attribution.

Why it matters

The breach is a textbook example of how attackers increasingly reach protected health information not by defeating a hospital's defences directly but by compromising a trusted third party and riding valid credentials into cloud systems. Because the exposed material spans billing passwords, PII, and PHI across patient management and EHR portals, affected individuals face a durable risk of medical-identity fraud and targeted phishing, and AdaptHealth faces the prospect of regulatory scrutiny under U.S. health-privacy rules once the forensic review establishes how many people were affected.