Was It Breached Secria

Recent breaches

AdaptHealth data breach: what leaked, and what to do

AdaptHealth, a Pennsylvania medical equipment company, reported a breach affecting 4,115,802 people to federal health regulators, as of 1 November 2026.1,2

Return to Kroll
P.O. Box 980108
West Sacramento, CA 95798

August 14, 2026

Dear Full name:

... the personal information involved may have included: your name, contact information, demographic information, health insurance information (such as your health plan name and policy number), and health information ...

We do not store Social Security numbers, individual financial account information or payment card information in the affected systems.

Visit Enroll.krollmonitoring.com/redeem ... You must activate your identity monitoring services by Deadline.

  1. The return address"Return to Kroll" in West Sacramento: Kroll is the firm AdaptHealth hired for the monitoring.2
  2. Insurance detailsYour health plan name and policy number may be involved, along with your equipment orders and referring provider.2
  3. No Social Security numbersThe company says the affected systems didn't hold them, or bank or card numbers.2
  4. Your deadlineEach letter prints its own activation date and code. The questions line is (844) 958-8963.2

Drawn from the sample letter AdaptHealth filed with California's attorney general. Checked 1 November 2026 against the sources.

The facts, as filed

"The company says" marks AdaptHealth's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says an unauthorized third party got into its systems on 5 June 2026 through a social engineering attack on a single company user account, and took data including patient information. It learned of this on 15 June.2
What the SEC filing adds
On 2 July 2026 AdaptHealth told the SEC that a threat actor contacted it on 15 June claiming to have data, that the session compromised was tied to a third-party contractor, and that a stored password file for insurance billing was taken.3
People affected
4,115,802 in AdaptHealth's report to the HHS breach portal, filed 14 August 2026, as of 1 November 2026.1 Its Texas filing, published 14 August 2026, counts 143,454 Texans.4 Washington's list counts 9,214 Washingtonians.5
What leaked
Name, contact and demographic information, health plan name and policy number, equipment order information and referring provider, the letter says. The Texas filing adds address and date of birth.2,4
Monitoring offer
Kroll credit monitoring, fraud consultation and identity theft restoration at no cost. The number of months and the activation deadline are printed in each letter.2
Lawsuit
As of 1 November 2026 we found no court-approved settlement, and no filed lawsuit we could read in a court record or company filing.

Ten days in June, then the letters

The dates come from AdaptHealth's letter, its SEC filing and the HHS list.

  1. The unauthorized access begins, the company says.2

  2. A threat actor contacts AdaptHealth claiming to have data.3

  3. AdaptHealth judges the incident material.3

  4. It reports the incident to the SEC.3

  5. Letters dated, and the HHS report filed: 4,115,802 people.2,1

What to do if you got an AdaptHealth letter

This breach is mostly health insurance and order details. The full checklist covers every data type.

  1. Activate the Kroll monitoring before your letter's deadline.At the site printed in the letter, with your activation code and verification ID. The code stops working after the deadline, the letter says.2
  2. Read your insurer's statements.The letter asks you to check statements from healthcare providers and insurers, and to report any charge you don't recognize to the company that sent it.2
  3. Think about a fraud alert.It's free, lasts one year and can be renewed. Contact one of the three credit bureaus.6
  4. Be careful with calls about your equipment or plan.Contact AdaptHealth or your insurer on a number you know is real, not one given in a text or email.7

Questions people ask

Is the AdaptHealth letter from Kroll real?

The sample AdaptHealth filed in California comes from "Return to Kroll", P.O. Box 980108, West Sacramento, CA 95798, is dated 14 August 2026, is signed by its chief compliance officer, and gives (844) 958-8963 for questions.2 Compare yours with it, and with our letter check.

Was my Social Security number in the AdaptHealth breach?

The company says no: it doesn't store Social Security numbers, financial account or payment card information in the affected systems. Neither its letter nor its Texas filing lists them.2,4

Is there an AdaptHealth data breach settlement or lawsuit?

We found no court-approved settlement and no filed lawsuit we could read as of 1 November 2026. A real settlement comes with a court-approved notice that names the case. This isn't legal advice.

Sources 7
  1. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 1 November 2026.
  2. AdaptHealth, LLC: filing and sample notice (reported 14 August 2026), California Attorney General. Read 1 November 2026.
  3. Form 8-K, Item 1.05, filed 2 July 2026, AdaptHealth Corp., via SEC EDGAR. Read 1 November 2026.
  4. Data Security Breach Reports, Office of the Texas Attorney General. AdaptHealth, LLC, published 14 August 2026. Read 1 November 2026.
  5. Data Breach Notifications, Washington State Office of the Attorney General. AdaptHealth, LLC, reported 14 August 2026. Read 1 November 2026.
  6. Credit freeze or fraud alert: Which is right for you?, Federal Trade Commission. Read 1 November 2026.
  7. Did you get an email saying your personal info is for sale on the dark web? (26 September 2022), Federal Trade Commission consumer alert. Read 1 November 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check