AdaptHealth confirms 4.1 million people exposed in July cyberattack
AdaptHealth confirms 4.1 million patients' data exposed in July cyberattack by ShinyHunters.
Healthcare provider AdaptHealth has confirmed that a cyberattack discovered in July exposed the data of over 4.1 million individuals. The breach, attributed to the ShinyHunters threat group, occurred on June 5 through a social engineering attack compromising a third-party contractor's account. Exposed data includes names, contact information, demographic details, health insurance information, and health information.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AdaptHealth?
Get an email when a new story names AdaptHealth, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe AdaptHealth breach demonstrates the critical risk posed by third-party contractors who have privileged access to sensitive healthcare systems. ShinyHunters exploited a compromised contractor account through social engineering — a human-focused attack vector that bypasses technical defenses entirely. Healthcare organizations are high-value targets because they hold both financial and medical data, making robust third-party access governance essential. This incident highlights that an organization's security posture is only as strong as its weakest external partner.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.