**AdaptHealth**, a major provider of home medical devices and services, has officially confirmed that a cyberattack discovered in July led to the exposure of data belonging to 4.1 million people. The company offers a wide range of services, including sleep-apnea and respiratory equipment, oxygen therapy, and mobility products. ### Incident Timeline and Attack Vector The breach was initially disclosed in a **U.S. Securities and Exchange Commission (SEC)** filing on July 2, 2026. **AdaptHealth** indicated that attackers had accessed its systems and exfiltrated private data. Further investigation revealed the intrusion occurred earlier and involved access to cloud-based business applications, patient management systems, document storage platforms, and electronic health record system portals. On June 15, an unnamed threat actor contacted **AdaptHealth** to demand a ransom, threatening to leak the stolen data. The company later confirmed on August 14 that the compromise originated on June 5 through a successful social engineering ploy that targeted and compromised the privileged account of a third-party contractor. ### Data Exposed and Impacted Individuals The exposed data potentially includes: * Full names * Contact information * Demographic information * Health insurance information * Health information **AdaptHealth** has begun notifying impacted individuals, providing instructions on how to enroll in a free 12-month credit monitoring and identity protection service. While the company stated it has found no evidence of identity theft, fraud, or other misuse of the stolen data, the scale of the breach is substantial. According to its website, **AdaptHealth** served approximately 4.1 million patients across all 50 U.S. states as of July 2024. A submission to the **U.S. Department of Health and Human Services** further clarifies that the **AdaptHealth** data breach affects precisely 4,115,802 individuals. ### The ShinyHunters Connection While **The HIPAA Journal** previously linked the **ShinyHunters** threat group to the attack based on their claims, **BleepingComputer** noted that **AdaptHealth**'s entry was no longer visible on **ShinyHunters**' extortion portal, suggesting a potential removal. This incident follows a series of recent data breach disclosures from other health-tech firms, including **Aesto Health**, **CareCloud**, and **Unlimited Technology Systems**. Companies like **McKesson** and **Nutex Health** have also reported breaches, though the number of impacted individuals is yet to be determined in those cases.