AdaptHealth Data Breach Exposes Health Information of 4.1 Million People

More than 4.1 million individuals have had their personal, health, and insurance information stolen following a data breach at healthcare provider AdaptHealth.

The company, which operates a network of over 680 medical equipment facilities across the United States, confirmed that the incident occurred in early June 2026. The breach resulted in the theft of sensitive data belonging to 4,115,802 people.

Attack Vector and System Compromise

The intrusion was facilitated by a threat actor using social engineering to compromise a user session at a third-party contractor. This access allowed the attacker to infiltrate AdaptHealth’s cloud-based applications, including internal systems used for patient management and document storage.

During the breach, the attacker successfully exfiltrated a password file associated with insurance billing. The stolen information includes names, contact details, demographic information, and health insurance records.

Data Impact and Regulatory Response

AdaptHealth stated that Social Security numbers and financial information were not affected by the incident.

The company has notified the US Department of Health and Human Services (HHS) of the breach. The incident was recently added to the HHS data breach portal after the company confirmed the scale of the impact.