US medical equipment provider AdaptHealth has disclosed a cyberattack that exposed patient information after hackers tricked a third-party contractor through a social engineering attack. The AdaptHealth data breach affected several cloud-based business applications. The company later determined the incident was material and notified the US Securities and Exchange Commission (SEC).
Social Engineering Attack Compromised Contractor Account
Hackers targeted a third-party contractor with a social engineering attack. They successfully hijacked an active user session and gained access to several cloud-based business applications.
After detecting the intrusion, AdaptHealth disabled the affected account and reset the compromised credentials. The company also introduced additional access controls to contain the attack.
On June 27, AdaptHealth concluded that the incident met the threshold for a material cybersecurity event. The decision reflected both the nature of the attack and the amount of data that could be at risk.
Hackers Accessed Patient Systems
According to the SEC filing, the attackers accessed internal patient management systems and document storage platforms.
They also stole passwords linked to insurance billing. The compromised data included personally identifiable information (PII) and protected health information (PHI) belonging to patients.
AdaptHealth said the affected systems do not store Social Security numbers. They also do not contain payment card information or individual financial account details. As a result, some of the most sensitive financial data was not exposed.
Investigation Remains Ongoing
AdaptHealth hired external digital forensics experts to investigate the breach. The specialists are working to determine how the attackers gained access and exactly what information they stole.
The company has not determined the full scope of the incident. It also does not yet know how many patients were affected.
AdaptHealth said it has already taken steps to help prevent any stolen data from spreading further.
No Ransom Demand Reported
No ransomware group has claimed responsibility for the attack so far.
AdaptHealth also said it has not received a ransom demand. The company did not report making any payment to the attackers.
The company cannot yet estimate the total financial impact of the breach. Costs could include incident response, legal expenses, regulatory investigations, patient notifications, and reputational damage.
However, AdaptHealth said its cybersecurity insurance may cover some of those losses.
Patient Care Continues
AdaptHealth said the breach has not disrupted its operations. Patients continue receiving medical equipment and services without interruption.
The investigation remains active as security experts continue assessing the attack and its overall impact.
0 responses to “AdaptHealth Data Breach Exposes Patient Information After Contractor Account Compromised”