Incident disclosureDisclosed 2026-07-02AdaptHealth Corp.SEC filing

AdaptHealth Corp. discloses a cybersecurity incident involving social engineering (SEC 8-K, July 2026)

AdaptHealth Corp. (the “Company”) is investigating a security incident whereby a threat actor gained unauthorized access to Company systems and exfiltrated certain data therefrom.

What happened

  • Specifically, based on information obtained to date, the Company believes that a threat actor gained unauthorized access to certain of the Company’s cloud-based business applications, including certain internal patient management systems and document storage platforms.Form 8-K Item 1.05, AdaptHealth Corp., filed 2026-07-02
  • On June 15, 2026, the Company received a communication from a threat actor claiming to have obtained certain data from the Company’s systems.Form 8-K Item 1.05, AdaptHealth Corp., filed 2026-07-02
  • The Company has confirmed that certain data was exfiltrated from its systems including a stored password file associated with insurance billing; the Company also has confirmed that certain external electronic health record system portals were accessed by the threat actor.Form 8-K Item 1.05, AdaptHealth Corp., filed 2026-07-02

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern