Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group.

The company provides home medical devices, supplies, and related services, including sleep-apnea and respiratory equipment, oxygen therapy, hospital beds, and mobility products.

AdaptHealth first disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on July 2, 2026, informing that attackers accessed its systems and exfiltrated private data.

At the time, AdaptHealth’s investigation confirmed the intrusion occurred earlier and involved access to cloud-based business applications, including certain internal patient management systems, document storage platforms, and electronic health record system portals.

On June 15, an unnamed threat actor contacted AdaptHealth to demand a ransom payment in exchange for not leaking the stolen data.

AdaptHealth added that the breach occurred through a successful social engineering ploy that compromised the privileged account of a third-party contractor.

In an update on August 14, AdaptHealth informed that the compromise had occurred on June 5 and may have exposed the following data:

• Full names
• Contact information
• Demographic information
• Health insurance information
• Health information

Impacted individuals should have already received a data breach notification with instructions on how to enroll in a free-of-charge 12-month credit monitoring and identity protection service.

AdaptHealth stated at the time that it had found no evidence of identity theft, fraud, or other misuse of data stolen in the attack.

According to information on the company’s website, AdaptHealth served about 4.1 million patients across all 50 U.S. states through a network of 680 locations as of July 2024.

In a submission to the U.S. Department of Health and Human Services, the AdaptHealth data breach affects 4,115,802 individuals.

The HIPAA Journal previously reported that ShinyHunters was responsible for the attack, based on the threat actor adding the company to the list of victims.

However, BleepingComputer coould not find an AdaptHealth entry on ShinyHunter's extortion portal, an indication that the threat actor removed the company.

AdaptHealth's confirmation of the data breach impact follows similar recent disclosures from health-tech firms Aesto Health, CareCloud, and Unlimited Technology Systems.

McKesson and Nutex Health also disclosed data breach incidents late last month, but neither has determined the number of impacted individuals yet.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report