4.1 Million Impacted by AdaptHealth Data Breach
Source SecurityWeek
Description
In June 2026, AdaptHealth, a US-based healthcare company operating over 680 facilities, suffered a data breach impacting over 4.1 million individuals. Hackers accessed cloud-based applications, including internal patient management and document storage systems, via social engineering targeting a third-party contractor. The stolen data includes personal, health, and insurance information, but excludes Social Security numbers and financial information. The breach was confirmed by AdaptHealth and reported to the US Department of Health and Human Services (HHS).
Impact
The breach exposed sensitive personal, health, and insurance information of over 4.1 million individuals, potentially risking privacy and enabling identity-related threats. However, Social Security numbers and financial information were not affected, which limits some categories of risk. The compromise of internal patient management and document storage systems may have operational and reputational impacts on AdaptHealth.
Defensive guidance
No specific patch or remediation is applicable as this breach resulted from social engineering and unauthorized access rather than a software vulnerability. Organizations should review third-party access controls and user session security. AdaptHealth has confirmed the breach and notified regulatory authorities. No further immediate action is indicated from the vendor advisory.
Summary
In June 2026, a threat actor gained unauthorized access to AdaptHealth's cloud-based systems through social engineering of a third-party contractor's user session. The attacker exfiltrated personal, health, and insurance data of approximately 4.1 million individuals. The breach involved internal patient management and document storage applications. Social Security numbers and financial data were not compromised. AdaptHealth publicly confirmed the breach and notified the HHS, which added the incident to its data breach portal.