AdaptHealth says social engineering of a contractor led to theft of patient data from cloud systems

AdaptHealth says attackers tricked a third-party contractor and then got into the company's cloud systems, stealing patient data. In its SEC filing, the home medical equipment provider said the intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, a password file tied to insurance billing, and some personally identifiable information and protected health information. The company said Social Security numbers and payment data are not currently believed to be affected, and it has not yet disclosed the full scope.