More than 4.1 million individuals had their personal, health, and insurance information stolen in a data breach at AdaptHealth, a healthcare company operating over 680 facilities across the United States. The network of medical equipment providers confirmed the incident after a threat actor gained access to its cloud-based applications in early June.
How the AdaptHealth Breach Occurred
According to the company, the attacker compromised a user session at a third-party contractor through social engineering. This provided access to internal systems used for patient management and document storage, including a password file associated with insurance billing.
On August 14, AdaptHealth announced that the threat actor had exfiltrated names, contact and demographic details, as well as health and health insurance information. The company stated that Social Security numbers and financial information were not affected.
At the time of disclosure, AdaptHealth notified the U.S. Department of Health and Human Services (HHS) that 4,115,802 individuals were impacted. HHS has since added the company to its official data breach portal.
Baylor Genetics Breach Exposes 2.8 Million Records
Another major healthcare breach reported to HHS on the same date, August 14, involves clinical genomics company Baylor Genetics. Like AdaptHealth, the Baylor Genetics intrusion occurred in June.
Hackers stole patients’ names, dates of birth, medical test data, health insurance information, and Social Security numbers. The personally identifiable information (PII) of Baylor Genetics employees was also compromised, along with their financial data.
Baylor Genetics reported to HHS that the electronic protected health information of 2,810,878 individuals was stolen in the incident.
Growing Wave of Healthcare Data Breaches
These incidents add to a mounting list of significant healthcare data breaches in recent months. Other notable cases include:
- Manchester Airports Group: Data on 8.8 million people leaked after a ransom refusal.
- Dark Web Listing: 153 million driver license images offered for sale.
- Nutex Health: Ransomware gang claims responsibility for a data breach.
- Aesto Health: 9.5 million individuals impacted by a data breach.
The consecutive reporting of the AdaptHealth and Baylor Genetics breaches underscores the persistent vulnerability of healthcare organizations to cyberattacks targeting sensitive patient data.
