AdaptHealth Says Hackers Took Patient Data After Contractor Session Was Compromised

AdaptHealth, which supplies CPAP machines, glucose monitors, insulin pumps and other home medical equipment, has disclosed that a threat actor gained unauthorized access to its systems and took patient data, according to a Form 8-K filed with the Securities and Exchange Commission on July 2.

The Conshohocken, Pennsylvania-based company said the data affected "includes passwords associated with insurance billing and certain personally identifiable information and protected health information of patients." It said it does not collect Social Security numbers in the affected systems and does not store individual financial account information or payment card information in them.

How the attack unfolded

According to the filing, the incident was the result of "a successful social engineering attack that compromised a user session associated with a third-party contractor." AdaptHealth said it believes the threat actor reached certain cloud-based business applications, including internal patient management systems and document storage platforms, and it confirmed that certain external electronic health record system portals were also accessed.

The company said it received a communication from a threat actor on June 15 claiming to have obtained data from its systems. On June 27, it determined that the incident was material, "due to the nature and potential volume of the data that is at risk." That determination triggered the filing under Item 1.05 of Form 8-K, the item public companies use to report material cybersecurity incidents.

After detecting the intrusion, AdaptHealth said it disabled the compromised user account, reset affected credentials and added access controls, and that the incident has been contained. It said it notified law enforcement and is investigating with external forensics teams. "The Company has since taken steps intended to mitigate the risk of dissemination of the exfiltrated data," the filing said, without describing those steps.

Scope and cost still unknown

AdaptHealth said the full scope of the affected data sets has not yet been determined and that specific information about the volume of data is not yet available. It said it would amend the filing as that information becomes available.

As of the filing date, the company said, the incident had not had a material impact on its operations and had not affected its ability to serve patients. It said it was unable to determine the full financial impact, including remediation and response costs, legal, regulatory and notification-related matters, and possible effects on patients, counterparties and its reputation. The company said it maintains cybersecurity insurance that may cover certain losses associated with the incident.

AdaptHealth's disclosure is the latest in a run of cyberattacks reported by medical device companies. Stryker, Intuitive Surgical, Medtronic and iRhythm have all disclosed attacks in recent months, MedTech Dive reported on July 7, adding that Stryker's attack led to manufacturing and shipping disruptions that lasted for weeks and meaningfully cut into its first-quarter earnings.