AdaptHealth breach exposes personal and health information of 4.1 million people
Attackers stole AdaptHealth patient data after compromising a contractor’s session. The breach affected 4,115,802 people. Affected patients should use the offered identity protection and check healthcare and insurance statements.
If you receive an AdaptHealth notice, follow its instructions to activate the free Kroll identity protection before the deadline printed in your letter. Check healthcare and insurance statements for unfamiliar activity and report questionable charges to the provider or insurer. For help or to ask whether you are affected, call AdaptHealth’s incident line on +1 844 958 8963.
What’s happening
US home medical equipment provider AdaptHealth suffered a data theft affecting 4,115,802 people. The attack began on 5 June 2026 and was discovered on 15 June, before its public disclosure on 2 July. Social engineering compromised a contractor’s user session, allowing access to company systems. Information involved may have included names, contact and demographic details, health insurance information and health information. AdaptHealth says the affected systems did not hold Social Security numbers, financial account details or payment card information. It contained the intrusion by disabling the account, resetting credentials and adding access controls. By 14 August, it had notified affected people with current contact details and offered at least 12 months of free identity protection. Its August notice reported no known misuse. As of 3 November, whether stolen copies have been recovered or deleted remains unknown; no software update can undo the exposure.
- What
- Breach
- Affects
- AdaptHealth patient services
- Fixed in
- Nothing to patch
- Since
- 5 June 2026
- Closed
- 9 Sept 2026
Timeline
- Update
BleepingComputer reported that AdaptHealth’s submission to US health regulators listed 4,115,802 affected individuals. Its headline described a July cyberattack, whereas AdaptHealth dates the attack to 5 June and discovery to 15 June.
- Update
AdaptHealth said it had notified affected individuals for whom it held current contact details and arranged free identity protection, including credit monitoring, for at least 12 months. It reported no known actual or attempted identity theft, fraud or other misuse.
- Made public
AdaptHealth publicly disclosed stolen patient information and an insurance-billing password file. It said the intrusion was contained after it disabled the compromised account, reset affected credentials and added access controls; the number affected was still unknown.
- Update
AdaptHealth discovered the intrusion after an attacker contacted it claiming to hold company data. The company launched an investigation with outside specialists and notified law enforcement.
- UpdateNothing to patch
An attacker accessed AdaptHealth systems and stole data, including patient information. AdaptHealth later traced the intrusion to social engineering that compromised a third-party contractor’s user session.
Sources
- AdaptHealth Notice of Cybersecurity IncidentAdaptHealth · 14 Aug 2026
- Form 8-K: Material Cybersecurity IncidentAdaptHealth · 2 July 2026
- AdaptHealth patient notification letterAdaptHealth · 14 Aug 2026
- AdaptHealth confirms 4.1 million people exposed in July cyberattackBleepingComputer · 9 Sept 2026
- AdaptHealth Data Breach Affects 4.1 Million IndividualsThe HIPAA Journal · 10 Sept 2026