PHILADELPHIA, September 16 — AdaptHealth, the publicly traded home medical equipment company, has confirmed that the electronic protected health information of 4,115,802 individuals was compromised in a cybersecurity incident, according to a notification filed with the U.S. Department of Health and Human Services Office for Civil Rights. The company disclosed the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission in early July 2026.
In that filing, AdaptHealth said a threat actor had contacted it on June 15, 2026, claiming to have obtained files containing patient data. AdaptHealth launched an investigation, engaged third-party cybersecurity experts, and notified law enforcement.
The company later determined that the attack occurred on June 5, 2026, and that the threat actor exfiltrated files containing names, contact information, demographic information, health insurance information, and health information.
What the investigation found
The investigation determined that the unauthorized access resulted from a response to a social engineering attack on a third-party contractor, which allowed the contractor’s credentials to be obtained. The threat actor obtained a stored password file tied to insurance billing and access to external electronic health record portals. Certain cloud-based business applications were accessed, including internal patient management systems and document storage platforms.
AdaptHealth added a notice to its website on August 14, 2026, providing further details. AdaptHealth said it does not collect patients’ Social Security numbers, and financial account information and payment card information are not stored in the compromised systems.
The company stated it is unaware of any actual or attempted misuse of the data; however, as a precaution, affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.
Ongoing review and response
The incident has not had an impact on operations or patient services, and a review is ongoing to determine the extent of data theft. AdaptHealth considers this a material cybersecurity incident due to the nature and potential volume of data at risk. The financial impact is still being assessed, with potential costs for forensics, breach notification, legal and regulatory responses, and remediation measures.
The company holds a cybersecurity insurance policy, which may cover certain losses. While AdaptHealth has not named the threat actor, this appears to have been a data theft and extortion attempt by the ShinyHunters threat group, which added AdaptHealth to its data leak site and threatened to leak the stolen data if a ransom was not paid.
There is currently no listing on the ShinyHunters data leak site, suggesting the entry has been removed. For the millions of patients whose information was caught up in this, the coming weeks will bring notification letters and the practical work of watching for signs of misuse.
What to watch next is whether the ongoing review turns up evidence of actual misuse, and how regulators respond to a breach of this scale at a company that supplies equipment and therapy products to people in their homes. Consult your doctor for medical advice.
