Healthcare organizations hold some of the most sensitive information in the world. Patient identities, medical information, insurance details, demographic records, billing information, and other personal data make healthcare systems highly attractive targets for cybercriminals.
A recent breach at AdaptHealth demonstrates how a compromise involving a third party and a user session can ultimately expose sensitive information belonging to millions of individuals.
According to the reported incident, more than 4.1 million individuals were affected after attackers gained access to AdaptHealth systems in June 2026. The company operates more than 680 facilities across the United States and provides healthcare solutions and medical equipment to patients.
The incident highlights a critical lesson for healthcare organizations:
Protecting internal systems is not enough when third party access, cloud applications, identities, and user sessions are part of the environment.
What Happened at AdaptHealth?
The reported attack involved unauthorized access to cloud based applications, including systems used for patient management and document storage.
According to AdaptHealth, the attacker used social engineering to compromise a user session associated with a third party contractor. The incident also involved the theft of a password file connected to insurance billing.
The company later determined that information had been exfiltrated from its systems.
The compromised information included:
• Names
• Contact information
• Demographic information
• Health information
• Health insurance information
The company reported that Social Security numbers and financial information were not affected.
AdaptHealth notified the U.S. Department of Health and Human Services that approximately 4,115,802 individuals were affected.
Why This Breach Matters
The scale of the incident is significant, but the method of access is equally important.
Organizations often invest heavily in firewalls, endpoint protection, vulnerability scanning, and network security while overlooking the security risks associated with identities and third party users.
An attacker does not always need to directly compromise a healthcare organization’s infrastructure.
A compromised contractor account, stolen session, exposed credential, or successful social engineering attack can potentially provide an initial path into business systems.
This makes identity security a fundamental component of healthcare cybersecurity.
Third Party Access Can Become a Major Attack Surface
Healthcare organizations rarely operate in isolation.
They work with:
• Medical equipment providers
• Billing companies
• Insurance organizations
• Healthcare technology vendors
• Cloud service providers
• IT service providers
• Consultants
• Business associates
• Patient service providers
These relationships often require access to applications and sensitive information.
The challenge is that every external identity and integration can introduce additional risk.
Organizations need visibility into who has access, what they can access, why they need that access, and whether that access remains necessary.
Social Engineering Remains Highly Effective
Technical vulnerabilities receive significant attention in cybersecurity, but attackers continue to rely heavily on manipulating people and identities.
Social engineering can target:
• Employees
• Contractors
• Vendors
• Help desk personnel
• Administrators
• Healthcare professionals
• Remote workers
Once an attacker successfully compromises an account or session, traditional security controls may not always distinguish between the legitimate user and the attacker.
This is why identity monitoring and behavioral analytics are becoming increasingly important.
Security teams need to understand not only whether authentication was successful, but also whether the behavior following authentication is normal.
Cloud Applications Need Stronger Security Controls
The AdaptHealth incident also demonstrates the importance of securing cloud based applications.
Healthcare organizations increasingly rely on cloud platforms for:
• Patient management
• Document storage
• Billing
• Insurance processing
• Communication
• Data analytics
• Electronic health records
• Workforce management
Cloud adoption can improve scalability and operational efficiency, but it also creates additional security responsibilities.
Organizations should continuously assess cloud configurations, identities, access privileges, application integrations, authentication mechanisms, and data protection controls.
Healthcare Data Requires Layered Protection
Healthcare information can have long term consequences when compromised.
Even when financial information is not involved, stolen health and insurance information can potentially be valuable for identity theft, fraud, targeted social engineering, and other malicious activities.
Organizations should therefore protect healthcare information throughout its lifecycle.
Security controls should cover:
• Data at rest
• Data in transit
• Cloud storage
• Applications
• APIs
• User identities
• Third party connections
• Endpoints
• Network infrastructure
• Backup systems
Security should not depend on a single defensive technology.
The Importance of Zero Trust
Healthcare organizations can benefit from adopting Zero Trust principles across applications and infrastructure.
Instead of automatically trusting an authenticated user, organizations should continuously evaluate:
• User identity
• Device security
• Location
• Application access
• Session behavior
• Risk indicators
• Privilege level
• Data sensitivity
Access should be limited to what is required for a specific role.
This becomes especially important when contractors and third party organizations are involved.
Least Privilege Can Limit Breach Impact
One of the most important controls for third party access is least privilege.
External users should receive only the permissions required to perform their assigned responsibilities.
Organizations should regularly review:
• Contractor accounts
• Vendor accounts
• Privileged accounts
• Service accounts
• API credentials
• Shared accounts
• Dormant accounts
• Temporary access
Access should also have defined ownership, expiration processes, and regular review requirements.
Healthcare Organizations Should Strengthen Third Party Risk Management
The AdaptHealth incident demonstrates why vendor security cannot be treated as a procurement checkbox.
Healthcare organizations should evaluate the cybersecurity posture of third parties before providing access to sensitive systems.
A mature third party risk program should include:
• Vendor security assessments
• Business associate security reviews
• Identity and access reviews
• Security questionnaire programs
• Contractual security requirements
• Data access limitations
• Continuous monitoring
• Incident notification requirements
• Penetration testing where appropriate
• Periodic reassessment of critical vendors
Third party security should remain an ongoing process rather than a one time evaluation.
What Healthcare Organizations Can Learn
Several practical lessons emerge from this incident.
1. Secure Every Identity
Employees, contractors, vendors, service accounts, and applications should all be treated as security identities requiring appropriate controls.
2. Monitor User Sessions
Security teams should look for unusual authentication behavior, impossible travel patterns, abnormal application access, and suspicious session activity.
3. Apply Strong Authentication
Organizations should implement strong authentication controls and phishing resistant authentication where appropriate.
4. Reduce Third Party Privileges
External users should have only the access necessary for their responsibilities.
5. Protect Sensitive Data
Sensitive healthcare and insurance information should be protected using appropriate encryption, access controls, monitoring, and data governance.
6. Monitor Cloud Environments
Cloud applications and storage should be continuously assessed for configuration weaknesses and unauthorized activity.
7. Test Security Controls
Penetration testing, vulnerability assessments, application security testing, and identity security reviews can help identify weaknesses before attackers exploit them.
8. Prepare for Incident Response
Healthcare organizations should have documented procedures for identifying, containing, investigating, and reporting security incidents.
Industries Beyond Healthcare Are Also at Risk
Although this incident involves a healthcare organization, the underlying security lessons apply to many industries.
Financial Services
Banks, insurers, fintech companies, and financial service providers rely heavily on third party vendors and cloud applications.
Strong identity security, API security, vendor assessments, continuous monitoring, and compliance controls can help reduce the risk of unauthorized access to financial systems.
Retail and E-commerce
Retail organizations manage large amounts of customer and payment information while working with logistics providers, technology vendors, payment processors, and cloud platforms.
Third party risk management and application security are essential for protecting customer data.
Manufacturing
Manufacturers increasingly rely on cloud applications, suppliers, contractors, and connected systems.
Security teams should protect both corporate IT environments and the integrations connecting external organizations to internal operations.
Government
Government agencies frequently work with contractors and external service providers that require access to sensitive systems.
Identity management, least privilege, continuous monitoring, and compliance driven security controls can help reduce third party risk.
Compliance Is Part of the Security Strategy
Healthcare organizations must also consider regulatory and privacy obligations when protecting sensitive information.
Security programs should align technical controls with applicable requirements and organizational policies.
For healthcare environments, this includes consideration of HIPAA and related privacy and security requirements.
For organizations operating across multiple sectors or geographic regions, additional requirements may include GDPR, PCI DSS, state privacy regulations, contractual obligations, and industry specific security standards.
Compliance should not be treated as separate from cybersecurity.
A strong security program should make compliance a natural outcome of effective security controls, monitoring, documentation, and governance.
Building a More Resilient Healthcare Security Program
Healthcare organizations should take a layered approach that combines:
• Identity and Access Management
• Zero Trust architecture
• Third party risk management
• Cloud security
• Data protection
• Application security
• API security
• Endpoint security
• Vulnerability management
• Security monitoring
• Incident response
• Compliance governance
This approach helps organizations reduce the likelihood of unauthorized access while improving their ability to detect and respond to suspicious activity.
Conclusion
The AdaptHealth breach is a significant reminder that protecting healthcare information requires more than securing internal networks.
The reported compromise involved social engineering, a third party user session, cloud based applications, and the exposure of sensitive health and insurance information affecting more than 4.1 million individuals.
The incident demonstrates why organizations need to treat identities, cloud applications, third party relationships, and sensitive data as interconnected parts of the cybersecurity landscape.
Healthcare organizations should continuously evaluate who can access their systems, what information those users can reach, how sessions are monitored, and whether third party access remains appropriate.
As cyber threats continue to evolve, organizations that combine strong identity security, continuous monitoring, data protection, application security, third party risk management, and compliance will be better positioned to protect sensitive information and maintain customer trust.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services
COE Security also helps organizations strengthen their security posture against identity based attacks, third party risks, cloud security threats, and sensitive data exposure through:
• Healthcare cybersecurity and HIPAA aligned security assessments
• Third party and vendor risk assessments
• Identity and Access Management assessments
• Privileged access security reviews
• Cloud security assessments
• Application and API security testing
• Data protection and governance assessments
• Vulnerability management programs
• Social engineering and security awareness assessments
• Penetration testing for web, mobile, API, cloud, network, and enterprise applications
• Secure Software Development Lifecycle implementation
• Security monitoring and AI enhanced threat detection
• Incident response planning and cybersecurity readiness
• Compliance readiness assessments for GDPR, HIPAA, PCI DSS, and applicable industry requirements
For healthcare and life sciences organizations, COE Security helps protect patient information, healthcare applications, cloud environments, medical technology ecosystems, third party connections, and systems handling sensitive health data.
For financial services organizations, we help secure customer information, financial applications, authentication systems, APIs, cloud environments, and third party integrations.
For retail and e-commerce organizations, we help protect customer data, payment environments, applications, APIs, cloud infrastructure, and vendor ecosystems.
For manufacturing organizations, we help secure enterprise applications, connected environments, cloud infrastructure, supply chain integrations, and IT and OT security ecosystems.
For government organizations, we help strengthen identity security, third party access controls, application security, vulnerability management, continuous monitoring, and compliance programs.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
Stay informed about emerging cybersecurity threats, healthcare security risks, data protection challenges, compliance developments, and practical strategies to help your organization stay updated and cyber safe.
Click to read our LinkedIn feature article