AdaptHealth Discloses Material Cybersecurity Incident Involving Patient Data

summarizeSummary

AdaptHealth Corp. disclosed a material cybersecurity incident involving unauthorized access to patient data and insurance billing passwords, stemming from a social engineering attack.

check_boxKey Events · Legal and Risk Events · AHCO

• Material Cybersecurity Incident

  AdaptHealth Corp. is investigating a security incident where a threat actor gained unauthorized access to company systems and exfiltrated certain data. The company determined the incident was material on June 27, 2026.

• Sensitive Data Exfiltrated

  The exfiltrated data includes passwords associated with insurance billing, personally identifiable information (PII), and protected health information (PHI) of patients. Social Security numbers and financial account information were not stored in the affected systems.

• Social Engineering Attack

  The incident resulted from a successful social engineering attack that compromised a user session associated with a third-party contractor. The incident has since been contained.

• Potential for Future Impact

  As of the filing date, the incident has not had a material impact on operations or patient service. However, the full financial impact, including remediation, legal, regulatory, and reputational costs, is currently undetermined. The company maintains cybersecurity insurance.

auto_awesomeAnalysis · AHCO · Industrial Applications And Services

AdaptHealth Corp. has reported a material cybersecurity incident where a threat actor gained unauthorized access to its systems and exfiltrated sensitive data, including patient personally identifiable information (PII), protected health information (PHI), and insurance billing passwords. While the company states the incident has not yet materially impacted operations, the exposure of such sensitive data carries significant legal, regulatory, and reputational risks, with the full financial impact still under investigation.