Article
How the breach unfolded
AdaptHealth, a home medical equipment provider, reported to federal regulators that 4,115,802 patients were affected by an attack earlier this year. In June, a social engineering attack compromised a third-party contractor’s user session, giving the attacker access to the company’s cloud-based patient management and document storage systems. On June 15, the attacker contacted AdaptHealth claiming to have stolen data. The company disclosed the intrusion in a July 2 securities filing and detailed the affected data in August.
Exposed information included names, contact and demographic details, health insurance and health information, and a password file tied to insurance billing. The company said Social Security numbers and financial and payment card data were not affected, and it is offering at least 12 months of credit monitoring.
Recovery takes longer than headlines suggest
A separate incident shows the operational side. Luminis Health in Annapolis, Md., first disclosed a cybersecurity incident on Sept. 1. By Sept. 16 it had restored telephone service at all locations so patients could again call physician offices directly, but its patient portal remained unavailable. Hospitals and clinics remained open, and teams were testing systems before bringing them back online. More than two weeks after disclosure, patient-facing services were still being rebuilt.
Where to look in your own organization
The AdaptHealth attack required no exotic technique; it began with a person being tricked. The Luminis incident shows how long full restoration can take. Leaders should focus on the access paths and recovery steps they control.
- Inventory third-party access. List every contractor and vendor with live sessions into clinical, billing or document systems, and confirm each one still needs it.
- Harden sessions, not only logins. Require phishing-resistant multifactor authentication, short session lifetimes and alerts for unusual contractor activity.
- Review downstream partners. Durable medical equipment, home health and billing partners hold large volumes of your patients’ data. Ask how they control their own contractors.
- Plan for weeks, not days. Test downtime procedures for phones, portals and scheduling, and decide in advance how patients will reach care teams.
- Prepare notifications. Confirm contracts specify how quickly partners must tell you about an incident involving your patients.
Archive entry for Sep 26, 2026, added Nov. 11, 2026.