AdaptHealth Corp. (NASDAQ: AHCO) disclosed a cybersecurity incident in which an unauthorized threat actor accessed company systems and removed certain data, according to a regulatory filing.

The company determined on June 27, 2026, that the incident is material, citing the nature and potential volume of data at risk. AdaptHealth said it received a communication from the threat actor on June 15, 2026, claiming to have obtained data from its systems.

The breach involved unauthorized access to cloud-based business applications, including internal patient management systems and document storage platforms. The company confirmed that a stored password file associated with insurance billing was exfiltrated, and that certain external electronic health record system portals were accessed.

Affected data includes passwords linked to insurance billing, as well as personally identifiable information and protected health information of patients. AdaptHealth stated that Social Security numbers, individual financial account information, and payment card information were not stored in the affected systems.

The incident stemmed from a social engineering attack that compromised a user session belonging to a third-party contractor. The company responded by disabling the compromised account, resetting credentials, and implementing additional access controls. The incident has been contained, AdaptHealth said.

The full scope of the affected data has not been determined. AdaptHealth said the incident has not materially affected operations or its ability to serve patients as of the filing date. The company said it is unable to determine the full financial impact at this time, including remediation costs, legal and regulatory expenses, and notification-related matters. AdaptHealth said it maintains cybersecurity insurance that may cover certain losses.

The company notified law enforcement and engaged external advisors and cybersecurity experts. An investigation with external forensics teams is ongoing.