AdaptHealth reports patient data and billing passwords taken after a social engineering attack

AdaptHealth, a home medical equipment provider, disclosed on July 2, 2026 that a threat actor had reached some of its cloud-based business applications and taken data, including a stored password file used for insurance billing and patient health information. The company determined the incident material on June 27.

How AdaptHealth described it

The company traced the intrusion to a contractor's session. It received a message from the threat actor on June 15 claiming to hold company data, and later confirmed exfiltration. Some external electronic health record portals were also accessed.

AdaptHealth said it does not collect Social Security numbers or store financial account or payment card data in the affected systems. The materiality decision rested on the data. Operations and patient service were not affected.

Still unknown

The volume of affected data had not been determined, and the filing does not say when the intrusion began.