AdaptHealth Says Cyberattack Compromised Data of Over 4 Million Individuals

AdaptHealth, a provider of home respiratory and related medical services, announced that a cyber intrusion discovered in July resulted in the exposure of personal information belonging to approximately 4.1 million people. The breach, which the company linked to the ShinyHunters threat group, prompted an internal investigation and external forensic analysis to determine the scope of the compromise.

According to the company’s statement, the compromised data includes names, contact details, dates of birth, and certain health‑related information tied to patients and customers who have used AdaptHealth’s services. While the notice did not specify the exact nature of the health data, the inclusion of such details raises concerns about potential identity theft and fraud, especially given the sensitivity of medical records.

ShinyHunters, a hacking collective known for targeting organizations in the healthcare and technology sectors, has been active in recent months, often demanding ransom after exfiltrating data. Law enforcement agencies have previously warned that the group’s tactics include publishing stolen information online if payment is not received, a practice that can amplify the damage to affected individuals.

AdaptHealth said it has taken steps to contain the breach, including disconnecting compromised systems, enhancing network monitoring, and working with cybersecurity experts to strengthen defenses. The company also notified relevant regulatory bodies, such as the U.S. Department of Health and Human Services’ Office for Civil Rights, which oversees compliance with HIPAA privacy rules.

Experts note that breaches of this magnitude underscore the growing vulnerability of the healthcare sector, which stores large volumes of personally identifiable information. The incident may prompt further scrutiny of the company’s security posture and could lead to increased oversight or penalties if investigations reveal lapses in compliance.

Individuals whose data may have been exposed have been advised to monitor their accounts for unusual activity and to consider enrolling in credit‑monitoring services. AdaptHealth indicated that it will provide additional resources and support to affected persons as the investigation continues, while also working to prevent similar incidents in the future.