AdaptHealth discloses credential theft and patient data breach

Impact verdict

Medium impact. Confirmed credential-theft-driven access to protected health information at a publicly traded US home medical equipment provider creates direct cyber liability (privacy class action, HIPAA regulatory exposure, OCR investigation), first-party cyber (forensics, notification, credit monitoring, potential business interruption), and supply-chain aggregation concerns via the contractor attack vector. The 'material' SEC characterisation and ~7% share-price decline indicate management and market view the event as financially significant, supporting D&O and reputational considerations. Notification volume, ransomware confirmation, exfiltration scope, and insurance programme structure remain undisclosed, keeping potential impact at MEDIUM.