Home medical equipment provider AdaptHealth disclosed that a June cyberattack exposed personal and health information belonging to more than 4.1 million patients, according to a filing with the HHS Office for Civil Rights.
The company said the breach stemmed from a social engineering attack that compromised a third-party contractor’s user session, giving a threat actor access to AdaptHealth’s cloud-based patient management and document storage systems. AdaptHealth first disclosed the intrusion in a July 2 SEC filing after the attacker contacted the company June 15 claiming to have stolen data.
In an Aug. 14 notice, AdaptHealth said the threat actor exfiltrated names, contact information, demographic data, health insurance information and health information, along with a password file tied to insurance billing. Social Security numbers, financial account information and payment card data were not affected, the company said.
AdaptHealth recently reported the number of affected individuals to HHS and said it notified all impacted patients for whom it had current contact information. The company is offering credit monitoring and identity protection services at no charge for at least 12 months.
The breach ranks among the largest healthcare data incidents reported to federal regulators this year, underscoring the exposure home health and durable medical equipment vendors face when third-party contractor access is compromised.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
