AdaptHealth Reports Social Engineering Attack Stole Patient Records via Contractor

AdaptHealth disclosed that cybercriminals employed social engineering tactics against one of its contractors to break into the medical equipment provider's cloud systems and make off with sensitive patient records.

Attackers targeted contractor to breach cloud environment. The Pennsylvania-based firm filed notice with the SEC on July 2 after learning on June 15 that intruders had accessed its networks. The breach reportedly gave the attackers entry to internal patient management systems, document storage platforms, and external electronic health record system portals.

The intruders removed a "password file associated with insurance billing" along with personally identifiable information and protected health information belonging to certain patients.

Company activates response and deems breach material. AdaptHealth immediately disabled the compromised contractor account, reset credentials, and strengthened access controls while launching its incident response plan. The company now considers the matter contained even as its probe continues to establish the breach's full extent.

By June 27 the firm had concluded that "due to the nature and potential volume of the data that is at risk" the incident qualified as material, obliging the regulatory filing. It added that it "has since taken steps intended to mitigate the risk of dissemination of the exfiltrated data."

No Social Security numbers or payment details affected. Social Security numbers and payment card information are not believed to have been taken. The filing did not confirm whether an extortion demand was received or paid, and no ransomware gang had publicly claimed the operation when the document was submitted.

Shares drop as company serves millions of patients. AdaptHealth, founded in 2012, supplies respiratory, sleep, and diabetes therapies to more than 4.2 million patients in all 50 US states per its 2024 annual report. The Register sought additional comment from the company on possible ransom demands and further safeguards against data misuse.

The incident is the latest example of healthcare organizations facing compromise through trusted third-party relationships.