A U.S. home medical equipment provider is currently probing a significant cyberattack that compromised patient details after bad actors utilized social engineering to hijack a third-party vendor’s login and infiltrate the firm’s cloud infrastructure.
AdaptHealth reported the incident via a Form 8-K filed with the U.S. Securities and Exchange Commission on July 2, revealing that a malicious actor gained unauthorized entry into multiple cloud-based business applications. These systems included internal patient management tools, document storage platforms, and external electronic health record portals.
Breach Details and Response
AdaptHealth stated that the breach led to the theft of patient records, comprising personally identifiable information, protected health information, and password files linked to insurance billing. Notably, the compromised systems did not hold Social Security numbers, individual financial account details, or payment card data.
The attack started when perpetrators executed a social engineering campaign against a third-party contractor, seizing an authenticated user session and granting access to AdaptHealth’s cloud-based resources. Once the intrusion was detected, the company disabled the compromised account, reset passwords, tightened access controls, and hired external digital forensics teams to investigate.
Read Also: AI Accelerates Post-Market Medical Device Surveillance
AdaptHealth noted that a threat actor initially reached out on June 15, claiming to possess proprietary company data. Following the inquiry, the firm decided on June 27 that the breach was material due to the incident’s nature and the possible quantity of sensitive data involved, thereby meeting SEC disclosure obligations.
Investigation Status and Potential Attribution
Although the forensic inquiry is ongoing, AdaptHealth has not revealed the number of affected patients or the full extent of the exposed data. Additionally, the company has not confirmed if a ransom demand was issued or if any negotiations occurred.
Recently, cybersecurity researchers have noted that the crime syndicate ShinyHunters has listed AdaptHealth on its data leak site, implying the group might be behind the assault. However, AdaptHealth has not officially linked the incident to any specific actor, and no law enforcement body has publicly validated the group’s involvement. Therefore, claims connecting the attack to ShinyHunters are currently unsubstantiated.
This incident contributes to a rising trend of cyberattacks against healthcare entities, where attackers are prioritizing identity-based attacks and social engineering over software vulnerabilities. By breaching trusted third-party accounts, malicious actors can circumvent standard security measures and access cloud-hosted systems containing sensitive patient data.
Read Also: Medtech firms struggle with AI accountability in regulatory work
The organization has implemented measures to minimize the spread of stolen information and emphasized that operations have not been interrupted and patient services remain unaffected.
AdaptHealth is still calculating the financial repercussions of the breach, which include incident response costs, legal and regulatory duties, costs for notifying patients, and possible reputational harm. The company pointed out that its cybersecurity insurance policy might cover some of these expenses.
Multiple U.S. law firms have declared probes into potential class-action lawsuits on behalf of individuals whose data may have been exposed. These investigations are in preliminary phases, and no court has yet certified a class action regarding the event.
AdaptHealth has not yet announced a timeline for notifying affected individuals, and the total count of impacted patients is currently unknown. The firm anticipates issuing further updates once its forensic investigation concludes and it has a more precise view of the breach’s scope.
