American medical equipment supplier hit by 4.1 million patient breach

More than 4.1 million individuals had their data compromised during a security incident in June, Pennsylvania medical equipment supplier AdaptHealth disclosed.

 

Headquartered in Pennsylvania, AdaptHealth is a leading U.S. provider of home medical equipment, supplies, and healthcare services designed to help patients manage chronic conditions at home. It specialises in respiratory, sleep and diabetes therapies and serves more than 4.2 million patients across all 50 states.

 

According to an SEC Form 8-K filing, AdaptHealth was notified by a threat actor on June 15, 2026, regarding potential access to patient files. Subsequent investigations confirmed that the attackers compromised a third-party contractor via social engineering to steal credentials, which they used to locate a stored insurance billing password and access external electronic health record portals.

 

“Specifically, based on information obtained to date, the Company believes that a threat actor gained unauthorized access to certain of the Company’s cloud-based business applications, including certain internal patient management systems and document storage platforms,” AdaptHealth said.

 

The company, however, confirmed that the compromised data did not include Social Security numbers, financial details such as credit or debit card numbers, or bank account information.

 

AdaptHealth initially kept the scale of the incident under wraps, but an updated filing with the U.S. Department of Health and Human Services confirmed that the breach ultimately involved as many as 4,115,802 people.

 

While AdaptHealth found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

The ShinyHunters cybercrime group claimed responsibility for the cyber attack, listing AdaptHealth as a victim on its data leak site. AdaptHealth has not confirmed ShinyHunters’ claims, nor has it disclosed whether a ransom demand was received or paid.