AdaptHealth breach exposes data of 4.1M patients

AdaptHealth reported that a hacker accessed its cloud-based applications in early June and stole personal, health and insurance information for 4,115,802 individuals.

The company says the attacker used social engineering to compromise a user session at a third‑party contractor, which allowed access to internal patient management and document storage applications. AdaptHealth disclosed the incident on Aug. 14.

AdaptHealth notified the U.S. Department of Health and Human Services (HHS) that the intruder exfiltrated names, contact and demographic information, and health and health insurance data. The company also reported theft of a password file tied to insurance billing.

AdaptHealth reported that Social Security numbers and financial account information were not affected. The company submitted the required notification to HHS, and the incident was added to HHS’s breach portal this week.

The addition to the HHS portal coincided with another entry for a June hack at Baylor Genetics that exposed electronic protected health information for 2,810,878 people. Baylor Genetics’ stolen data included patient names, dates of birth, medical test data, health insurance information and Social Security numbers, along with employee personal and financial information.

AdaptHealth operates more than 680 facilities across the United States and manages cloud systems that handle patient records and insurance billing processes.