AdaptHealth says attackers sweet-talked their way into cloud systems and stole patient data

AdaptHealth says attackers sweet-talked their way into cloud systems and stole patient data

Third-party contractor compromise exposed health information and insurance billing passwords

AdaptHealth says attackers used social engineering to breach its systems and steal sensitive patient data, including passwords associated with insurance billing.The medical equipment company disclosed the attack to the Securities and Exchange Commission (SEC) on Thursday, noting that attackers accessed internal patient management systems, document storage platforms, and external electronic health record system portals.The attack targeted an unwitting third-party contractor, through which the cybercriminals gained entry to the company's cloud environment, where they accessed business applications holding sensitive data.

AdaptHealth activated its incident response protocols soon after the attacker contacted the company on June 15 and disclosed the theft.

It did not specify whether an extortion demand was made, nor whether one was paid, and no cybercrime group had claimed responsibility at the time of writing.The company's response included disabling the contractor's user account, resetting credentials, and implementing additional access controls. It believes the attack is now contained.In addition to the "password file associated with insurance billing," AdaptHealth confirmed that personally identifiable information (PII) and protected health information of certain patients were also stolen.Social Security numbers and payment details are not thought to be affected.On June 27, AdaptHealth determined that "due to the nature and potential volume of the data that is at risk," the attack can be considered material, requiring disclosure to the SEC.