AdaptHealth

ShinyHunters socially engineered a third party contractor and took the credentials to a privileged account. From there the attackers located a stored insurance billing password and used it to reach external electronic health record portals.

AdaptHealth confirmed 4.1 million people affected on September 9. The company later traced the intrusion back to June 5, which puts roughly three months between first access and public confirmation.

Internal patient management systems and document storage platforms, plus data reached through external electronic health record portals. AdaptHealth stated the exposed data did not include Social Security numbers, credit or debit card numbers, or bank account information.

That exclusion is worth reading precisely. It rules out the identifiers that drive financial fraud. It does not rule out the clinical and equipment records that a home medical equipment supplier holds, which describe conditions, mobility, oxygen dependence and in home care arrangements. That information does not expire and cannot be reissued.

Patients who receive medical equipment at home, which selects for people who are elderly, chronically ill or disabled. The record says what is wrong with them and where they live.

This is the population least able to absorb a targeted approach and most likely to be reached by one. A caller who knows the equipment, the supplier and the delivery address is credible in a way a generic scam is not. The financial identifiers being absent reduces one class of harm and does nothing about this one.

The contractor had a privileged account, which is normal in healthcare logistics where billing, delivery and clinical systems are operated by partners. Restricting that access to a third party rather than granting it broadly is the conventional control.

The stored billing password is where the reasoning fails. A credential kept inside a system for convenience turns any compromise of that system into a compromise of everything the credential opens. The contractor account was the door. The stored password was the map.

Three months from first access on June 5 to confirmation of 4.1 million on September 9. Attackers moved from a contractor account to a stored credential to external portals, which means they were discovering the shape of the estate while inside it.

A stored insurance billing password sitting in reachable content is the detail that defines this incident. Nobody knew it was there. It was not in an inventory, because credentials in documents and configuration files are exactly the category that inventories miss, and they are findable by anyone willing to read the files.

The attackers performed content discovery on the estate. They did it second, after the owner had the same opportunity and did not take it.

ShinyHunters, which by September 2026 has a long record against large customer and patient databases. The pattern is consistent: social engineering to a credential, credential to a connected system, connected system to bulk export.

Naming the group settles very little for the 4.1 million. Attribution does not shorten notification, does not change what was taken, and does not recover a clinical history from wherever it now sits.

Removing the stored credential. The account compromise was the opening move, and it only scaled because a password was sitting in content where an intruder could read it.

Finding that credential first is an ordinary content inspection problem. Passwords, keys and tokens left inside documents and configuration are discoverable by scanning the same material an attacker reads. The difference between June 5 and September 9 is not detection speed. It is that the estate had never been examined for what it was holding.