In July 2026, AdaptHealth disclosed a cyberattack attributed to the ShinyHunters threat group that exposed data of approximately 4.1 million people. The breach originated from a social engineering attack that compromised a privileged account of a third-party contractor, allowing attackers to access cloud-based business applications, internal patient management systems, document storage, and electronic health record portals. The exposed data includes full names, contact and demographic information, health insurance details, and health information. AdaptHealth notified affected individuals and provided a 12-month free credit monitoring and identity protection service. The company has found no evidence of identity theft or misuse of the stolen data. The breach was first disclosed in an SEC filing on July 2, 2026, with the compromise occurring on June 5, 2026.

The breach exposed sensitive personal and health-related information of over 4.1 million individuals, potentially risking privacy and confidentiality. Although no evidence of identity theft or fraud has been reported, the exposure of health insurance and health information could lead to future misuse or targeted attacks. The incident also highlights risks associated with third-party contractor access and social engineering attacks in healthcare environments.

AdaptHealth has notified affected individuals and offered a free 12-month credit monitoring and identity protection service. The breach resulted from a social engineering attack compromising a third-party contractor's privileged account. Organizations should review and strengthen third-party access controls and implement enhanced monitoring for privileged accounts. Since this is a breach incident rather than a software vulnerability, no patch is applicable. Follow vendor and regulatory guidance for breach notification and remediation.