AdaptHealth told federal regulators that 4,115,802 people were caught up in a cyberattack on the company. That is the figure now on the Department of Health and Human Services breach portal, and it covers patients who got home medical gear through the company’s network.
AdaptHealth supplies sleep-apnea and respiratory equipment, oxygen therapy, hospital beds and mobility products. SecurityWeek counts more than 680 facilities across the country.
How the attacker got in
The company first disclosed the incident in a filing with the SEC on July 2, 2026. On June 15 an unnamed threat actor had contacted AdaptHealth, demanding a ransom in exchange for not leaking stolen data. The company’s later update, dated August 14, placed the actual compromise on June 5.
The way in was a person, not a software hole. AdaptHealth said a social engineering ploy compromised the privileged account of a third-party contractor. From there the intruder reached cloud-based business applications, including internal patient management systems, document storage and portals for electronic health records. A password file tied to insurance billing was also taken, SecurityWeek reported.
What was taken
The stolen files held full names, contact details, demographic information, health insurance information and health information. Social Security numbers and financial information were not affected, the company said.
Affected people should already have a notification letter explaining how to enroll in free credit monitoring and identity protection for 12 months. A reader in Hawaii told the Honolulu Star-Advertiser that her letter came from Kroll, the firm handling enrollment, with a sign-up deadline of Nov. 13, 2026. AdaptHealth said it had found no evidence of identity theft, fraud or other misuse of the data.
Who is behind it
HIPAA Journal reported that the ShinyHunters group was responsible, because it had added AdaptHealth to its list of victims. BleepingComputer could not find an AdaptHealth entry on the group’s extortion portal, which suggests it was removed.
The disclosure follows similar ones from Aesto Health, CareCloud and Unlimited Technology Systems. Baylor Genetics reported a separate June hack to the same federal portal on the same day as AdaptHealth, with 2,810,878 people affected.
Sources
- News in the Healthcare category
- Kokua Line: What did AdaptHealth do about data breach? | Honolulu Star-Advertiser
- AdaptHealth confirms 4.1 million people exposed in July cyberattack
- 4.1 Million Impacted by AdaptHealth Data Breach – SecurityWeek
