← BACK TO FEED
data breachhealthcareAdaptHealthBaylor Geneticssocial engineering

4.1 Million Patients Hit as AdaptHealth Suffers Cloud Breach

A data breach at US healthcare company AdaptHealth compromised the personal, health, and insurance information of over 4.1 million individuals after a threat actor used social engineering to access cloud-based systems in early June. The attacker exfiltrated names, contact details, and health and insurance information, though Social Security numbers and financial data were reportedly unaffected. A separate breach at clinical genomics company Baylor Genetics, also occurring in June, impacted nearly 2.8 million individuals, with hackers stealing a broader range of data including Social Security numbers and employee financial information.

AdaptHealth, a US medical equipment provider operating across more than 680 facilities nationwide, has confirmed a data breach affecting just over 4.1 million people. Names, contact details, demographic data, and health insurance information were all taken. Social Security numbers and financial data were reportedly left untouched, which is something at least.

The breach happened in early June, when attackers got into AdaptHealth's cloud-based systems, including platforms used for patient management and document storage. The initial foothold came via social engineering, with the attacker compromising a session belonging to a user at a third-party contractor. From there, they helped themselves to a password file tied to insurance billing.

The company went public on August 14, simultaneously notifying the US Department of Health and Human Services. HHS has now added AdaptHealth to its official breach portal, putting the confirmed victim count at 4,115,802.

If one major healthcare breach wasn't enough, the same HHS portal update also surfaced a separate incident at Baylor Genetics, a clinical genomics firm. Also breached in June, Baylor had patient names, dates of birth, medical test results, health insurance details, and Social Security numbers stolen. Unlike AdaptHealth, Baylor's staff weren't spared either, with employee personal and financial information also caught up in the haul. The company reported 2,810,878 individuals affected.

Healthcare remains a consistently soft target. Cloud systems, third-party contractors, and social engineering form a reliable attack path, and the sector keeps walking into it.

READ NEXT
Clover Health Investments Hit by Social Engineering Attack, Patient Data ExposedApollo Global Hit by Social Engineering Attack Exposing Names, Contacts and SSNsApollo Global Got Social Engineered. SSNs Walked Out the Door.