AdaptHealth is investigating a material cybersecurity incident after a threat actor gained unauthorized access to certain company systems and exfiltrated data.
In a filing with the U.S. Securities and Exchange Commission (SEC), AdaptHealth says it received communication from a threat actor on June 15th, 2026, claiming possession of company data.
According to the home medical equipment provider, the bad actor had unauthorized access to cloud-based business applications, including internal patient management systems and document storage platforms.
AdaptHealth confirms certain data was stolen, including a stored password file associated with insurance billing, as well as personally identifiable information and protected health information of patients.
“The incident was the result of a successful social engineering attack that compromised a user session associated with a third-party contractor. Following detection, the Company promptly implemented containment measures, including disabling the compromised user account, resetting affected credentials, and implementing additional access controls, and the incident has been contained. The Company is continuing to investigate the nature and scope of the incident with external forensics teams. The full scope of affected data sets has not yet been determined, and specific information regarding the volume of data at issue is not yet available. The Company has since taken steps intended to mitigate the risk of dissemination of the exfiltrated data.”
For now, the firm says the cybersecurity event has not had any impact on its operations or its ability to serve patients. AdaptHealth adds that it maintains cybersecurity insurance to cover potential losses stemming from the data breach.
Follow us on X, Facebook and Telegram
Don't Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Surf The Daily Hodl Mix
