AdaptHealth Breach Exposes 4.1M Patients' Health Data

AdaptHealth sells the equipment that sits next to your bed. CPAP machines, oxygen concentrators, hospital beds, mobility aids, diabetes supplies, delivered to homes in all 50 states. That inventory is the story here, because a customer list from a company like this is not a list of names. It is a list of diagnoses. BleepingComputer reported the confirmed figure on September 9, 2026.

Key Takeaways

• AdaptHealth confirmed on September 9, 2026 that 4,115,802 individuals had data exposed in an intrusion that began on June 5, 2026.
• The attacker socially engineered a third party contractor out of privileged credentials, then used that access to reach a stored insurance billing password that unlocked external electronic health record portals.
• Exposed categories were full names, contact information, demographic information, health insurance information and health information; AdaptHealth says Social Security numbers, card numbers and bank account details were not in the affected systems. Source: HIPAA Journal
• AdaptHealth filed a Form 8-K describing a material cybersecurity incident on July 2, 2026, updated the data categories on August 14, and notified the HHS Office for Civil Rights in September.
• The extortion listing was attributed to ShinyHunters and later disappeared from the group's leak portal, which usually means a negotiation rather than a retraction.

How Did Attackers Reach 4.1 Million Patient Records?

They did not break anything. A third party contractor with a privileged account was socially engineered into handing over credentials, and every step after that used legitimate access exactly as designed. teiss reported that the attacker then located a stored insurance billing password inside that environment and used it to reach external electronic health record portals.

Read that chain again, because it is the whole incident. Credential one belonged to a vendor. Credential two was sitting in a file or a password field somewhere inside the systems credential one could see. Nobody compromised the EHR portals directly. They were opened with a key that had been left in a drawer in a different building.

Cloud business applications, internal patient management systems and document storage platforms were all reachable from that starting point. The forensic timeline is short: intrusion on June 5, and on June 15 the threat actor contacted AdaptHealth directly to say it had the data. Ten days is not a dwell time problem. It is a blast radius problem.

Why "No Social Security Numbers" Is Not the Reassurance It Sounds Like

AdaptHealth says it does not collect Social Security numbers and that payment card and bank account data were not stored in the affected systems, and most coverage has led with that line. For financial fraud, it genuinely matters. For social engineering, it is close to irrelevant.

A Social Security number lets a criminal open a credit line. It does not let them write an email you believe. Health insurance information plus a named respiratory or sleep therapy device does exactly that, and it does not expire, cannot be reissued, and will still be true about you in 2036. The HHS Office for Civil Rights breach portal now catalogs more than a billion individuals affected since 2009, and the entries with no financial data attached are the ones that age worst.

4,115,802 people is roughly the population of Los Angeles, and unlike a retail customer list this one is filtered by medical need. An attacker holding it can select everyone on oxygen therapy and write to that subset only.

Is This the Same ShinyHunters Healthcare Campaign?

It follows the same pattern. ShinyHunters spent 2026 running human first intrusions against large organizations, phoning or messaging staff and vendors rather than hunting for unpatched software, and healthcare has been a repeat target. Google's Threat Intelligence Group has tied the broader cluster to breaches at more than 400 organizations across telecom, education, healthcare, retail and finance.

AdaptHealth is the third large healthcare data set we have covered from this ecosystem in under a month, after the 284 million McKesson patient records ShinyHunters claimed in August and the MyDr breach that exposed medical data on 19 million people in Poland. Health-ISAC has already warned providers about the group's voice phishing campaign against help desks and vendor accounts.

The AdaptHealth listing has since vanished from the leak site. That rarely means the data was deleted. It usually means someone paid, which sets the price for the next hospital supplier that gets the same phone call.

What This Means for Your Inbox

Contact information paired with a named medical condition is premium phishing fuel, and AdaptHealth's product mix hands an attacker the pretext already written. If the stolen record says sleep therapy, the lure writes itself: your CPAP supply reorder needs confirmation, your insurance authorization is expiring, your mask resupply shipment is on hold pending payment.

Generic phishing fails because nothing in it is true. This is the opposite. The device is real, the insurer is real, the supplier relationship is real, and the recipient is a person who genuinely is waiting on medical supplies. That combination beats the instinct most people rely on, which is noticing that a message does not apply to them. The same dynamic played out after Carnival's 6 million record breach, where stolen loyalty details fed targeted follow on phishing — except a cruise booking is not a medical dependency.

Assume the follow on wave arrives by email first and phone second, and assume it knows more about you than a normal scam does.

How Do You Verify a "Your Equipment Order" Email?

Verify it outside the message, every time, using a number you already had. That single rule defeats almost every version of this lure, and the FTC's phishing guidance is built around it.

• Call the number on your invoice or delivery paperwork. Not the number in the email, not the number in the text message that arrives ten minutes later.
• Treat payment urgency as the tell. A supplier that has billed your insurer for years does not suddenly need a card number to release a shipment today.
• Never confirm details back to a sender. A real supplier already has your member ID and your device model. Being asked to "verify" them is the attack.
• Check your explanation of benefits statements. Medical identity theft shows up as claims for equipment you never received, and IdentityTheft.gov has the reporting path.
• Take the free credit monitoring anyway. AdaptHealth is offering 12 months of monitoring and identity protection to affected individuals. It will not stop a phishing email, but it costs nothing.

The Contractor Is Your Perimeter

Nothing in this breach required a vulnerability. A vendor account, a conversation, and a password someone had saved for convenience produced 4.1 million exposed patients, which is a reminder that business associate compromise remains one of the dominant patterns in healthcare breach data. The uncomfortable part for defenders is that the second credential mattered more than the first. Inventory where privileged passwords are stored, because an attacker will find them faster than your next access review will.

For patients there is no configuration to change. What is left is a durable habit: when a message about your medical equipment arrives, answer it on a number you looked up yourself. The data is already gone. The next step is still yours.