AdaptHealth Corp.

AdaptHealth, LLC, a health sector entity reported a other incident to the Washington Attorney General. The organization became aware of the incident on 2026-06-15 and filed notice on 2026-08-14. 9,214 Washington residents were affected. 60 days elapsed between awareness and notification. 10 days to identify the breach. 0 days to contain the breach.

AdaptHealth, LLC experienced a data breach where an unauthorized third party accessed company systems on June 5, 2026, via a social engineering attack targeting a single user account. The company became aware of the incident on June 15, 2026. Affected data included patient names, contact info, demographic info, health insurance details, and health information (e.g., DME orders). No SSNs or financial account data were stored in affected systems. The company engaged forensics experts, secured systems, revoked credentials, notified law enforcement, and offered identity monitoring via Kroll.

AdaptHealth, LLC reported to HHS on 2026-08-14 a Hacking/IT Incident affecting 4,115,802 individuals. Breached information located on Network Server.

AdaptHealth, LLC based in Conshohocken, Pennsylvania, a healthcare – medical provider entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-06-15 and reported on 2026-08-14. 143,454 Texas residents were affected. 4,115,802 individuals affected in total. Types of information involved: Name of individual;Address;Medical Information;Health Insurance Information;Other;Date of Birth. Consumers were notified via Notice by publication in print media;Posted at company website or special website;U.S. Mail.

AdaptHealth, LLC reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-08-14. The reporting organization type is Health Care. 48,090 Vermont residents were affected. Categories of data breached: Health Records.

AdaptHealth Corp. filed an 8-K on June 27, 2026, disclosing a material cybersecurity incident. A threat actor gained unauthorized access to cloud-based business applications, including patient management systems, via a social engineering attack compromising a third-party contractor's session. The actor exfiltrated data including insurance billing passwords, PII, and PHI. The incident has been contained, law enforcement was notified, and the scope of affected individuals remains undetermined.