AdaptHealth Breach Exposes Health Data of 4.1 Million Patients

AdaptHealth confirmed that a cyberattack exposed the personal and health information of 4,115,802 individuals. The intrusion began on June 5, 2026, after attackers allegedly used social engineering to compromise a privileged account belonging to a third-party provider, gaining access to cloud applications, patient-management systems, document storage, and electronic health-record portals.

Exposed data includes identity and contact details, demographic information, health-insurance information, and protected health information. An unidentified actor issued a ransom demand on June 15; ShinyHunters is suspected because AdaptHealth briefly appeared on the group’s extortion portal, though the company has not formally attributed the incident to the group.