AdaptHealth declared its breach material 12 days after it discovered the intrusion
The Item 1.05 filing names a contractor's hijacked session, an exfiltrated insurance-billing password file and patient health data, and promises amendments as the still-open investigation produces facts.
The Board Room · Leadership desk
What happened
- AdaptHealth Corp. told the SEC under Item 1.05 that a threat actor reached cloud-based business applications including internal patient management systems and document storage platforms.
- The company said it determined on June 27, 2026 that the incident was material because of the nature and potential volume of data at risk, with its investigation still running.
- That notice says the affected information did not include social security numbers, credit or debit card details, or bank account information.
Why it matters
- Who has to decide decision The determination date is the company's own to set, and every later filing gets read against it.
- What it limits constraint A vendor programme built around issuing and revoking contractor credentials still misses a live session in a contractor's hands. That is what failed here.
- What doesn't add up contradiction An investor reading the 8-K learns that a billing credential file was exfiltrated; a patient reading the August notice gets categories of information, so the two audiences cannot compare exposure.
- What it sets up precedent Filing an unfinished investigation with an explicit promise to amend gives other healthcare registrants a workable pattern for disclosing before the scope is settled.
Next story · Invest · 8h ago
Strategy puts a 12% daily STRC dividend to a common shareholder vote on October 28Confirmed3 publishers
AdaptHealth wrote that "To the extent any information required by Item 1.05 of Form 8-K was not determined or was unavailable at the time of this filing, the Company will amend this Current Report on Form 8-K as such information is determined or becomes available" [11]. That sentence sits just before the safe-harbour language, and it is the one other filers will copy, because it lets a company report an intrusion it has not finished investigating [12].
The August notice says AdaptHealth discovered on June 15 that it had been attacked on June 5 [6], ten days earlier [19]. The 8-K puts something else on June 15: the company received a communication from a threat actor claiming to have obtained data from its systems [2]. The materiality determination came twelve days after the discovery [16].
AdaptHealth said it decided the incident was material "due to the nature and potential volume of the data that is at risk" [9], and said in the same filing that the investigation was continuing [12]. Materiality here rested on that characterisation. By then it had activated its incident response procedures, brought in external advisers and cybersecurity experts, and notified law enforcement [5].
AdaptHealth disabled the compromised user account, reset affected credentials, added access controls, and said the incident has been contained [4]. Those steps covered systems it controls. The access it describes went past its own tenancy: the actor was inside cloud-based business applications, and the filing also confirms that certain external electronic health record system portals were accessed [1][3].
AdaptHealth said the incident was "the result of a successful social engineering attack that compromised a user session associated with a third-party contractor" [10]. That puts the control question on live sessions.
To the SEC, AdaptHealth named what was exfiltrated: a stored password file associated with insurance billing [3]. To individuals in August, it described categories of information that may have been affected, said it was not aware of any actual or attempted identity theft, fraud or other misuse, and offered at least twelve months of credit monitoring at no charge [7][14][15]. The registrant on the 8-K is AdaptHealth Corp.; the notice comes from AdaptHealth, LLC [8][6]. Forty-eight days separate the determination from that notice [17], and seventy days separate the attack from it [18].
The 8-K does not state a number of affected individuals or an estimate of financial impact [13]. What it does is put June 27 on the record as the date the company decided the incident was material [9] and bind the company to amend as facts arrive [11], two fixed points a regulator or a plaintiff can measure against.
What to watch
- An amendment to the June 27 8-K adding an affected-individual count, a cost estimate or a wider scope of systems.
- Any move from AdaptHealth's position that it is not aware of misuse to identified fraudulent billing activity using the stolen insurance-billing passwords.
- Whether AdaptHealth Corp. quantifies the incident's financial impact in a later periodic filing.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption55
- Hype gap−15
- Incentives78
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The company believes a threat actor gained unauthorized access to certain of its cloud-based business applications, including certain internal patient management systems and document storage platforms.
- [2]
On June 15, 2026, the Company received a communication from a threat actor claiming to have obtained certain data from the Company's systems.
- [3]
The Company confirmed that certain data was exfiltrated from its systems including a stored password file associated with insurance billing, and confirmed that certain external electronic health record system portals were accessed by the threat actor.
- [4]
The company implemented containment measures including disabling the compromised user account, resetting affected credentials and implementing additional access controls, and said the incident has been contained.
- [5]
Upon learning of the incident the company activated its incident response procedures, launched the investigation with the support of external advisors and cybersecurity experts, and notified law enforcement.
- [6]
AdaptHealth, LLC announced on August 14, 2026 from Conshohocken that on June 15, 2026 it discovered it had been targeted by a cyber attack on June 5 that led to unauthorized access to certain company systems containing personal information.
- [7]
The investigation revealed the affected personal information may have included names, contact information, demographic information, health insurance information and health information, and did not include social security numbers, financial information including credit or debit card information, or bank account information.
- [8]
AdaptHealth Corp. filed a Form 8-K under Item 1.05 Material Cybersecurity Incidents stating it is investigating a security incident in which a threat actor gained unauthorized access to Company systems and exfiltrated certain data.
- [9]
The 8-K states that on June 27, 2026, the Company determined that the incident is material, "due to the nature and potential volume of the data that is at risk."
- [10]
The 8-K states the incident was "the result of a successful social engineering attack that compromised a user session associated with a third-party contractor."
- [11]
The filing states: "To the extent any information required by Item 1.05 of Form 8-K was not determined or was unavailable at the time of this filing, the Company will amend this Current Report on Form 8-K as such information is determined or becomes available."
- [12]
The 8-K says the investigation is ongoing while the company has been able to confirm certain facts about the incident.
- [13]
The 8-K as filed does not state a number of affected individuals or an estimate of the incident's financial impact.
- [14]
AdaptHealth said it is not aware of any actual or attempted identity theft, fraud, or other misuse of the affected information as a result of this incident.
- [15]
AdaptHealth notified all impacted individuals for whom it had current contact information and arranged identity protection services including credit monitoring at no charge for at least 12 months.
- [16]
Twelve days elapsed between the June 15, 2026 discovery and the June 27, 2026 materiality determination.
- [17]
Forty-eight days elapsed between the June 27, 2026 materiality determination and the August 14, 2026 public notice to individuals.
- [18]
Seventy days elapsed between the June 5, 2026 attack and the August 14, 2026 notice.
- [19]
Ten days elapsed between the June 5, 2026 attack and AdaptHealth's June 15, 2026 discovery of it.
Sources
2 independent publishers whose own reporting we read for this story.
- https://adapthealth.com/blogs/notices/adapthealth-notice-of-cybersecurity-incident-1
adapthealth.com
1 article · September 12, 2026
- AdaptHealth Corp._June 27, 2026
edgar-mirror.sec-api.io
1 article · September 12, 2026
Topics and entities
Topics
- SEC Cyber Incident Disclosure
- Social Engineering and Voice Phishing
- Credential Storage and Password Hashing
- Healthcare Data Breach
- Third-party contractor access
Entities
- Item 1.05 of Form 8-K
- SEC