Loading story…
AdaptHealth confirmed that a cyberattack exposed the personal and health information of 4,115,802 individuals. The intrusion began on June 5, 2026, after attackers allegedly used social engineering to compromise a privileged account belonging to a third-party provider, gaining access to cloud applications, patient-management systems, document storage, and electronic health-record portals.
Exposed data includes identity and contact details, demographic information, health-insurance information, and protected health information. An unidentified actor issued a ransom demand on June 15; ShinyHunters is suspected because AdaptHealth briefly appeared on the group’s extortion portal, though the company has not formally attributed the incident to the group.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
After AdaptHealth notified the U.S. Department of Health and Human Services that 4,115,802 individuals were affected, HHS added the incident to its data-breach portal.
AdaptHealth published an update confirming the June 5 compromise date and the categories of exposed data. The breach affected 4,115,802 individuals.
AdaptHealth submitted an initial disclosure about the incident to the U.S. Securities and Exchange Commission.
An unidentified malicious actor contacted AdaptHealth and demanded a ransom in exchange for not disclosing the stolen data.
AdaptHealth's cloud business applications, patient-management systems, document storage platforms, and electronic medical-record portals were compromised after social engineering targeted a privileged account belonging to a third-party provider. The intrusion exposed identity, contact, demographic, health-insurance, and health information.
The ShinyHunters cybercrime group claimed responsibility for the AdaptHealth intrusion and listed the company on its data-leak site. AdaptHealth had not confirmed the group’s claim.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecuritymagazine.com
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026
Healthcare and pharmaceutical distributor McKesson disclosed that unauthorized actors accessed certain third-party applications and exfiltrated data affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The incident was linked to a purported ShinyHunters “pay or leak” extortion campaign, in which the group allegedly published data after McKesson did not pay. The published dataset reportedly contains **6.4 million unique email addresses** alongside personal and corporate information involving marketing recipients, patients, employees, and healthcare-provider contacts. McKesson said it had reasonable assurance that unauthorized activity was no longer ongoing, while affected organizations should assess potential phishing, credential-stuffing, and impersonation risk arising from the exposed contact data.
Sep 10, 2026
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026