More than 4.1 million individuals had their personal, health, and insurance information stolen in a data breach at healthcare company AdaptHealth.
Operating over 680 facilities across the US, AdaptHealth describes itself as a network of medical equipment companies that provides patients with healthcare solutions and medical equipment.
The company was hacked in early June, when a threat actor gained access to its cloud-based applications, including internal systems used for patient management and document storage.
After the attacker contacted the company, it confirmed the data breach, including the theft of a password file associated with insurance billing.
The hacker used social engineering to compromise a user session at a third-party contractor, AdaptHealth said.
On August 14, the company announced that the threat actor had exfiltrated names, contact and demographic information, and health and health insurance information.
The company said Social Security numbers and financial information were not affected.