BleepingComputer (9 September 2026) reports AdaptHealth confirmed about 4.1 million people were exposed in a cyberattack discovered in July.

SEC filing 2 July 2026 disclosed access to cloud business apps including patient management, document storage, and EHR portals.

Company update: compromise on 5 June 2026 via social engineering of a third-party contractor's privileged account; an unnamed threat actor demanded a ransom on 15 June in exchange for not leaking the stolen data; data classes named include names, contact and demographic data, health insurance, and health information. HHS submission lists 4,115,802 individuals. Notifications and 12-month credit monitoring offered. No Australian nexus identified this pass.

Primary: BleepingComputer (company filings).

Correction (24 Oct 2026): Removed the ShinyHunters attribution: BleepingComputer says it rested on the group listing AdaptHealth on its leak site (as reported by HIPAA Journal), which is not independent confirmation; AdaptHealth refers only to an unnamed threat actor. (source: BleepingComputer)