AdaptHealth, a Pennsylvania-based home medical equipment provider serving more than 4.2 million patients across all 50 US states, has disclosed a security incident to the Securities and Exchange Commission in which attackers used social engineering against a third-party contractor to breach its cloud environment and steal protected health information, personally identifiable information, and a password file tied to insurance billing. The company reported the breach to the SEC on Thursday, roughly two weeks after the attackers themselves made contact on June 15.
What Happened
According to the SEC disclosure, the intrusion began not with a technical exploit but with a person. Attackers targeted an unwitting third-party contractor and leveraged that access to move into AdaptHealth's cloud environment. From there, they reached business applications holding sensitive data, including internal patient management systems, document storage platforms, and external electronic health record system portals.
The company did not learn of the compromise through its own monitoring. Instead, the attackers contacted AdaptHealth directly on June 15 and disclosed the theft, at which point the company activated its incident response protocols. On June 27, AdaptHealth determined that, "due to the nature and potential volume of the data that is at risk," the incident qualified as material and required SEC disclosure.
As of the disclosure, no cybercrime group had claimed responsibility, and the company did not say whether an extortion demand was made or paid. Investigations into the full scope remain ongoing.
What Was Taken
AdaptHealth confirmed the theft of three categories of data. First, and most unusual, a "password file associated with insurance billing" was exfiltrated, exposing credentials used to interact with billing and payer systems. Second, personally identifiable information belonging to certain patients was stolen. Third, protected health information of certain patients was taken.
The company stated that Social Security numbers and payment details are not thought to be affected. It has not disclosed the exact number of affected patients or the volume of records involved, citing an ongoing investigation, though its materiality determination hinged specifically on the "potential volume" of data at risk.
Why It Matters
This incident is a textbook illustration of third-party risk converging with identity-based attack techniques. The attackers never needed to defeat AdaptHealth's perimeter directly; they borrowed a trusted contractor's access and walked into the cloud environment. For a healthcare organization holding PHI at the scale of 4.2 million patients, the blast radius of a single trusted account is enormous.
The stolen insurance-billing password file is a particularly sharp detail. Storing credentials in a centralized file, rather than a secrets manager, remains distressingly common. Such a file hands an attacker a ready-made map of downstream systems and payer relationships, enabling potential billing fraud, further lateral movement, and impersonation against insurers well after the initial breach is contained.
Because the attackers reached out to the victim rather than posting to a leak site, this has the hallmarks of a quiet extortion play. Organizations should assume the exfiltrated data is a live bargaining chip regardless of any public claim.
The Attack Technique
Social engineering against a third party is the operative technique here. Rather than phishing an AdaptHealth employee directly, the attackers compromised a contractor whose account was trusted inside AdaptHealth's cloud tenant. This mirrors a broader trend of adversaries targeting the weakest identity in a supply chain, then using legitimate credentials to access business applications where alerting and anomaly detection are often weakest.
AdaptHealth's containment response is instructive about the access path: it disabled the contractor's user account, reset credentials, and implemented additional access controls, stating it believes the attack is now contained. The remediation steps map directly to a compromised-identity scenario rather than malware or a software vulnerability. The company also said it has taken steps intended to mitigate the risk of the exfiltrated data being disseminated.
What Organizations Should Do
- Inventory and scope every third-party and contractor identity with access to cloud tenants and business applications, and enforce least-privilege plus just-in-time access rather than standing entitlements.
- Require phishing-resistant multi-factor authentication (FIDO2 or hardware keys) for all external and contractor accounts, closing the social-engineering path that bypasses passwords alone.
- Eliminate plaintext credential files. Move billing, payer, and application secrets into a managed secrets vault with rotation, access logging, and no shared static passwords.
- Deploy identity threat detection that flags anomalous contractor logins, unusual access to patient management and EHR portals, and bulk document-storage access.
- Rehearse a contractor-compromise scenario in tabletop exercises, and pre-define containment actions such as rapid account disablement and tenant-wide credential resets.
- Treat any attacker-initiated contact as active extortion: preserve evidence, engage counsel and law enforcement early, and assume exfiltrated data will be leaked or sold.
Sources: AdaptHealth: Crooks stole our passwords, patient health data