8-K: AdaptHealth Discloses Material Cybersecurity Incident

AdaptHealth Corp. has disclosed a material cybersecurity incident involving unauthorized access to its systems and exfiltration of patient data, including passwords for insurance billing.

Summary

• AdaptHealth Corp. is investigating a security incident where a threat actor gained unauthorized access to company systems and exfiltrated data.
• The incident was identified on June 15, 2026, when the company received a communication from a threat actor claiming to have obtained data.
• The company determined the incident to be material on June 27, 2026.
• The unauthorized access involved cloud-based business applications, including internal patient management systems and document storage platforms.
• Exfiltrated data includes passwords associated with insurance billing, and certain personally identifiable information and protected health information of patients.
• Social security numbers, individual financial account information, or payment card information were not collected or stored in the affected systems.
• The incident resulted from a social engineering attack that compromised a third-party contractor's user session.
• Containment measures have been implemented, including disabling the compromised account and resetting credentials.

Sentiment

Score: 3

Explanation: StockSavvy.ai views this as a negative development due to the material cybersecurity incident involving patient data exfiltration, despite containment efforts and lack of immediate operational impact.

Positives

• The company promptly activated incident response procedures and launched an investigation with external advisors and cybersecurity experts.
• Law enforcement has been notified.
• Containment measures have been implemented, including disabling the compromised user account, resetting affected credentials, and implementing additional access controls.
• The incident has been contained.
• The incident has not had a material impact on the company's operations as of the date of the report.
• The incident has not affected the company's ability to service its patients.
• The company does not collect Social Security numbers or store individual financial account information or payment card information in the affected systems.
• The company maintains cybersecurity insurance that may cover certain losses.

Negatives

• A threat actor gained unauthorized access to company systems and exfiltrated certain data.
• The incident is considered material due to the nature and potential volume of data at risk.
• Certain external electronic health record system portals were accessed by the threat actor.
• The full scope of affected data sets has not yet been determined.
• Specific information regarding the volume of data at issue is not yet available.
• The company is unable to determine the full financial impact of the incident, including remediation and response costs, legal, regulatory and notification-related matters, and possible effects on patients, counterparties and the company's reputation.

Risks

• Potential publication or misuse of affected data by the threat actor or other parties.
• Legal, regulatory, reputational, and financial risks resulting from the incident.
• Risk of additional cybersecurity incidents.
• The ongoing assessment of the incident may reveal a broader scope or greater impact.
• Uncertainty regarding the adequacy of cybersecurity insurance coverage.
• Potential negative impact on patients, counterparties, and the company's reputation.

Future Outlook

The company is continuing to investigate the nature and scope of the incident and is unable to determine the full financial impact at this time. The company will amend this report as such information is determined or becomes available. Actual results may differ materially from forward-looking statements due to ongoing assessment, potential misuse of data, and legal, regulatory, reputational, and financial risks.

Management Comments

• The company is investigating a security incident whereby a threat actor gained unauthorized access to Company systems and exfiltrated certain data therefrom.
• Upon learning of the incident, the Company promptly activated its incident response procedures, launched the investigation with the support of external advisors and cybersecurity experts to assess and contain the threat and notified law enforcement.
• The Company does not collect Social Security numbers in the affected systems and does not store individual financial account information or payment card information in those systems.
• The incident has not had a material impact on the Company's operations and has not affected the Company's ability to service its patients.
• At this time, the Company is unable to determine the full financial impact of the incident, including remediation and response costs, legal, regulatory and notification-related matters, and possible effects on patients, counterparties and the Company's reputation.

Industry Context

StockSavvy.ai notes that this incident highlights the persistent and evolving cybersecurity threats facing healthcare providers, particularly concerning sensitive patient data and the reliance on cloud-based systems. The healthcare sector remains a prime target for cyberattacks due to the high value of personal health information.

Stakeholder Impact

• Shareholders: Potential negative impact on reputation and financial performance due to incident costs and potential liabilities.
• Patients: Risk of exposure of personally identifiable information and protected health information, leading to potential identity theft or fraud.
• Counterparties: Potential reputational and financial risks.
• Regulators: Potential for regulatory scrutiny and fines related to data privacy and security.

Next Steps

• Continue investigation into the nature and scope of the incident.
• Assess the full extent, categories, and volume of data accessed or exfiltrated.
• Determine the full financial impact of the incident.
• Amend the Form 8-K as more information becomes available.

Key Dates

Keywords

cybersecurity incident, data exfiltration, AdaptHealth Corp., patient data, unauthorized access, Form 8-K, healthcare IT, data breach