AdaptHealth
Disclosed Jul 2, 20262 months ago4,115,802 affectedConfirmed
AdaptHealth confirms 4,115,802 people exposed after contractor account hijack
Home medical equipment provider AdaptHealth told the SEC that social engineering compromised a third-party contractor's privileged account in June 2026, followed by a ransom demand. It later reported 4,115,802 affected people to HHS; ShinyHunters was named as the attacker.
What is known
| People affected | 4,115,802 (as reported to HHS) |
|---|---|
| Disclosed | Jul 2, 2026 |
| Discovered | Jun 15, 2026 |
| Happened | Jun 5, 2026 |
| Attack | Phishing |
| Data exposed | Names, Health, Emails, Phone numbers, Addresses, Insurance, Dates of birth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: AdaptHealthoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: AdaptHealthatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report: AdaptHealth (Healthcare Provider, PA)ocrportal.hhs.gov · Official notice | Official notice |
| AdaptHealth Corp. Form 8-K, Item 1.05 (2026-07-02)sec.gov · SEC filing | SEC filing |
| AdaptHealth notice of cybersecurity incidentadapthealth.com · Official notice | Official notice |
| AdaptHealth confirms 4.1 million people exposed in July cyberattackbleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0005258: AdaptHealthoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: AdaptHealthago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| SEC 8-Ktotal | Jul 2 | |
| Researchtotal | Jul 2 | 4,115,802 |
| California AGresidents of CA | Aug 14 | |
| Washington AGresidents of WA | Aug 14 | 9,214 |
| HHS OCRtotal | Aug 14 | 4,115,802 |
| Texas AGresidents of TX | Aug 14 | 143,454 |
| Vermont AGresidents of VT | Aug 14 | 48,090 |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: ["names","health","emails","phone","addresses","insurance"] to ["names","health","emails","phone","addresses","insurance","dob"] · backfill source
- 2026-09-25 · attack: hacking to phishing · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","emails","phone","addresses","insurance"] · seed source
- 2026-09-25 · summary: empty to Home medical equipment provider AdaptHealth told the SEC that social engineering compromised a third-party contractor's privileged account in June 2026, followed by a ransom demand. It later reported 4,115,802 affected people to HHS; ShinyH · seed source
- 2026-09-25 · title: Material cybersecurity incident reported to the SEC (8-K Item 1.05) to AdaptHealth confirms 4,115,802 people exposed after contractor account hijack · seed source
- 2026-09-25 · disclosed: 2026-08-14 to 2026-07-02 · backfill source
- 2026-09-25 · title: empty to Material cybersecurity incident reported to the SEC (8-K Item 1.05) · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 4115802 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-06-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.