AdaptHealth Corp. 8-K

What Happened AdaptHealth Corp. announced a security incident in which a threat actor gained unauthorized access to certain cloud-based business applications, exfiltrating data including a stored password file associated with insurance billing and personally identifiable/protected health information (PII/PHI). The Company received a communication from the threat actor on June 15, 2026, and on June 27, 2026 determined the incident was material. The Company says the attack resulted from a successful social engineering compromise of a third‑party contractor user session. AdaptHealth activated its incident response plan, engaged external cybersecurity and forensics experts, notified law enforcement, and implemented containment measures.

Key Details

• Incident timeline: threat actor contacted the Company on June 15, 2026; Company determined the incident was material on June 27, 2026.
• Data affected: passwords tied to insurance billing, certain PII and PHI; Company states affected systems do not contain Social Security numbers or payment card/account data.
• Cause and containment: attack via social engineering of a third‑party contractor session; compromised account disabled, affected credentials reset, additional access controls implemented and incident contained to date.
• Operational and financial status: no material impact on operations or patient service as of filing; full scope and financial impact (remediation, legal, notification costs, reputational effects) remain undetermined. Company carries cybersecurity insurance that may cover some losses.

Why It Matters This is a material data-security event involving patient-related and insurance-billing information, which can lead to remediation costs, regulatory and notification obligations, and reputational risk—factors investors should monitor. Although AdaptHealth reports no current disruption to operations, the company cannot yet quantify potential financial impacts. Investors should watch for follow-up disclosures on the scope of data exfiltrated, any regulatory findings or fines, remediation expenses, and any effects on patient trust or contractual relationships.