AdaptHealth Patient Data Stolen via Contractor Phishing: What Was Exposed & What To Do

On June 27, 2026, AdaptHealth reported that threat actors had obtained patient records and insurance billing passwords after compromising a third-party contractor through social engineering. The company filed the disclosure with the U.S. Securities and Exchange Commission the same day and stated that its operations continued without interruption. The number of individuals whose information was taken has not been made public. The incident centers on unauthorized access to AdaptHealth’s cloud environment. Attackers used stolen contractor credentials to reach systems that store patient records and billing information. Specific files removed included records from management and document systems along with passwords used for insurance billing. No further technical details about the duration of access or the volume of data have been released.

Breaking down the breach

AdaptHealth disclosed the event on June 27, 2026, after determining that a contractor’s account had been used to enter its cloud systems. The entry method described is social engineering aimed at the contractor rather than a direct attack on AdaptHealth’s own infrastructure. Once inside, the actors copied patient records and insurance billing passwords. The company has not published the number of records involved or the time period during which the access occurred.

How a breach like this happens

Incidents that begin with a contractor often follow a common pattern. Attackers first identify vendors or service providers that hold credentials for a target organization. They then craft messages or calls designed to obtain login details, a technique known as social engineering. When successful, the stolen credentials allow entry into the primary organization’s systems, where data can be located and copied without triggering immediate alarms. Organizations frequently learn of such access only after reviewing logs or receiving external notification.

AdaptHealth and its sector

AdaptHealth operates in the healthcare services sector, providing equipment and related support to patients. Entities of this type routinely maintain electronic records that contain treatment details, insurance information, and identifiers required for billing and regulatory compliance. Because these records are necessary for ongoing care and reimbursement, they are stored in systems that multiple internal teams and external contractors must access. A compromise in this setting therefore touches both clinical and financial data flows that patients and insurers rely upon.

What data was at risk

The disclosure names patient records, insurance billing passwords, and personal health information as the categories taken. The exact contents of the records, such as specific fields or date ranges, have not been itemized. Organizations in this sector commonly hold demographic details, medical histories, insurance identifiers, and billing credentials, yet the precise combination present in the stolen material remains unconfirmed beyond the categories already stated.

What's at stake

Individuals whose records were copied face the possibility that their health and insurance details could be used for fraudulent claims or identity-related activity. Insurance billing passwords, if still valid, could allow unauthorized transactions until they are changed. For AdaptHealth, the event adds to regulatory reporting obligations and may prompt reviews of contractor access controls, though the company reported no immediate effect on service delivery. The absence of a confirmed count of affected people leaves the full scope of potential impact unknown at this stage.

What to do if you're exposed

Anyone who receives a notification from AdaptHealth or a related provider should review the letter for instructions on monitoring accounts and changing passwords. Individuals can also request a free credit report and place a fraud alert with the major credit bureaus. Running a free exposure scan of an email address against known breach data provides one way to check whether the address has appeared in previously published incidents. Keeping software updated and avoiding reuse of passwords across sites remain basic steps that limit further exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.