AdaptHealth reports material cybersecurity incident; patient data exfiltrated via social engineering

AdaptHealth Corp.

• Threat actor gained unauthorized access to cloud-based business applications including patient management systems and document storage.
• Exfiltrated data includes passwords for insurance billing and patient personally identifiable and protected health information.
• Incident resulted from social engineering attack on a third-party contractor; compromised user session disabled and credentials reset.
• Company determined incident material on June 27, 2026; investigation ongoing with external forensics.
• No material operational impact to date; full financial impact including remediation and legal costs not yet determinable.