AdaptHealth Corp., one of the largest home medical equipment and respiratory care providers in the United States, has confirmed a data breach affecting approximately 4.1 million individuals. The company notified the U.S. Securities and Exchange Commission of the incident and has since issued breach notifications consistent with HIPAA Breach Notification Rule requirements (45 CFR §§ 164.400–414), including reporting to the HHS Office for Civil Rights as a breach affecting more than 500 individuals.
For healthcare security teams, this is not just another breach headline. It is a reminder that large-scale PHI exposure continues to be driven by the same repeatable attack pattern: initial access to a corporate environment or mailbox, quiet reconnaissance against systems storing patient data, and bulk collection of protected health information before anyone notices. When a single incident touches 4.1 million records, the dwell time and data staging involved are almost never trivial.
If you operate a healthcare SOC, manage a business associate environment, or hold PHI anywhere in your estate, this incident should trigger an immediate review of your email compromise detections, PHI access auditing, and third-party exposure.
Technical Analysis: What We Know and What the Attack Chain Typically Looks Like
Based on AdaptHealth's disclosures, the incident involved unauthorized access to systems within its environment containing sensitive patient information. As with most large healthcare breaches disclosed through SEC filings and HHS OCR reporting, the data at risk spans the classic PHI spectrum: patient names, dates of birth, contact information, medical record and treatment details, and — critically for downstream fraud — insurance and billing identifiers.
No CVE has been associated with this incident, and none should be assumed. Large healthcare breaches of this scale overwhelmingly trace back to one of three initial access vectors, and defenders should posture against all three simultaneously:
- Credential phishing / business email compromise (BEC) — A single compromised mailbox in a billing, HR, or clinical coordination role can expose years of PHI transmitted via attachments. Attackers then create malicious inbox rules to hide their activity and quietly harvest or exfiltrate mail.
- Third-party / business associate compromise — Healthcare entities are legally entangled with dozens of vendors. A compromise at a billing processor, collections agency, or IT provider becomes your breach under HIPAA.
- Exposed or weakly authenticated remote access — VPN, RDP, or legacy webmail portals without phishing-resistant MFA remain a top entry point against healthcare networks.
The attack chain in these incidents is depressingly consistent: valid account access (MITRE ATT&CK T1078) → mailbox or file-share discovery (T1083, T1213) → collection of PHI (T1005, T1114) → staging and exfiltration (T1567). Because every step uses legitimate credentials and legitimate protocols, prevention fails silently — which means detection engineering carries the entire weight.
Exploitation status: This is a confirmed, disclosed breach with regulatory notification — not a theoretical threat. The techniques involved (credential phishing, mailbox manipulation, bulk data access) are among the most heavily used against the healthcare sector right now and remain firmly in the top tier of the HHS Health Sector Cybersecurity Coordination Center (HC3) threat picture for 2025–2026.
Detection & Response
The detections below target the behaviors that matter most in healthcare PHI breaches: malicious inbox rule creation, anomalous sign-in patterns consistent with credential theft, and bulk access to mail or files containing patient data. These are deliberately scoped to high-fidelity behaviors — tune thresholds to your environment before pushing to production.
Sigma Rules
---
title: Suspicious Inbox Rule Created to Hide or Forward Mail
description: Detects creation of inbox rules that delete, move to hidden folders, or forward mail externally — a hallmark of business email compromise used to conceal attacker activity in healthcare breaches.
references:
- https://attack.mitre.org/techniques/T1098/002/
- https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
product: office365
service: exchange
detection:
selection_operation:
Operation:
- 'New-InboxRule'
- 'Set-InboxRule'
selection_suspicious:
Parameters|contains:
- 'DeleteMessage'
- 'ForwardTo'
- 'ForwardAsAttachmentTo'
- 'RedirectTo'
- 'MoveToFolder'
- 'MarkAsRead'
condition: selection_operation and selection_suspicious
falsepositives:
- Legitimate user-created forwarding rules (common in billing departments); baseline and alert on new/changed rules only
level: high
---
title: Impossible Travel or Anomalous Sign-In to Cloud Mailbox
description: Detects sign-ins from geographies or ASNs inconsistent with the user's baseline, a strong indicator of stolen credential use against healthcare mail systems.
references:
- https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
product: azure
service: signinlogs
detection:
selection:
riskLevelDuringSignIn:
- 'high'
- 'medium'
filter_known:
location|contains:
- 'US'
condition: selection and not filter_known
falsepositives:
- Traveling staff; executive assistants using VPN egress in other states — suppress known VPN ASNs and approved travel
level: high
---
title: Bulk File Access to PHI Repositories via SMB
description: Detects a single account reading an abnormally high volume of files on file servers hosting patient records — indicative of collection prior to exfiltration.
references:
- https://attack.mitre.org/techniques/T1005/
- https://attack.mitre.org/techniques/T1039/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\\patients'
- '\\medical_records'
- '\\billing'
- '\\phi'
condition: selection
falsepositives:
- Backup service accounts and EHR integration service accounts — exclude by service account SID and alert only on interactive/user accounts
level: medium
KQL — Microsoft Sentinel / Defender
// Hunt 1: New inbox rules with forwarding or hiding behavior (Exchange Online via OfficeActivity)
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
| extend RuleParams = tostring(Parameters)
| where RuleParams has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "DeleteMessage", "MoveToFolder")
| project TimeGenerated, UserId, ClientIP, Operation, RuleParams
| sort by TimeGenerated desc
;
// Hunt 2: Risky sign-ins followed by mailbox activity (correlate Entra sign-in risk with Exchange ops)
let riskyUsers = SigninLogs
| where TimeGenerated > ago(14d)
| where RiskLevelDuringSignIn in~ ("high", "medium")
| summarize FirstRiskySignIn = min(TimeGenerated), make_set(Location) by UserPrincipalName, IPAddress;
riskyUsers
| join kind=inner (
OfficeActivity
| where TimeGenerated > ago(14d)
| where OfficeWorkload =~ "Exchange"
| summarize OpsCount = count(), Operations = make_set(Operation) by UserId
) on $left.UserPrincipalName == $right.UserId
| project UserPrincipalName, FirstRiskySignIn, IPAddress, set_Location, OpsCount, Operations
;
// Hunt 3: Mass file reads on servers hosting PHI (Defender for Endpoint)
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath has_any ("patients", "medical_records", "billing", "ehr", "phi")
| where ActionType == "FileCreated" or InitiatingProcessCommandLine has_any ("copy", "xcopy", "robocopy", "7z", "rar")
| summarize FileCount = count(), DistinctFiles = dcount(FileName) by DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| where FileCount > 500
| sort by FileCount desc
Velociraptor VQL
-- Hunt for evidence of data staging and archive creation on endpoints
-- (bulk compression of patient data is a common pre-exfiltration step)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(7z|7za|winrar|rar|zip|tar).*(-p|a\s|encrypt)'
OR Name =~ '(?i)^(7z|7za|rar|winrar)'
-- Enumerate recently created large archives in user-writable and staging directories
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Downloads/*.zip', 'C:/Users/*/Downloads/*.7z',
'C:/Users/*/Documents/*.rar', 'C:/ProgramData/**/*.zip',
'C:/Temp/**/*.7z'])
WHERE Size > 10485760
AND Mtime > (timestamp(epoch=now() - 604800) ).Unix
ORDER BY Mtime DESC
Remediation & Audit Script
# Audit Exchange Online for suspicious inbox rules (BEC indicator sweep)
# Requires: ExchangeOnlineManagement module, appropriate admin role
Connect-ExchangeOnline
$report = foreach ($mbx in (Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox)) {
Get-InboxRule -Mailbox $mbx.UserPrincipalName -ErrorAction SilentlyContinue | Where-Object {
$_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or
$_.DeleteMessage -eq $true -or $_.MoveToFolder -match 'RSS|Archive|Junk'
} | ForEach-Object {
[PSCustomObject]@{
Mailbox = $mbx.UserPrincipalName
RuleName = $_.Name
ForwardTo = ($_.ForwardTo -join ';')
RedirectTo = ($_.RedirectTo -join ';')
DeleteMsg = $_.DeleteMessage
MoveToFolder = $_.MoveToFolder
}
}
}
$report | Export-Csv -Path ".\InboxRule_Audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
$report | Format-Table -AutoSize
# Block legacy auth and enforce MFA posture (review before applying tenant-wide)
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State
# Then: disable per-user mailbox legacy protocols where not needed
# Set-CASMailbox -Identity user@domain.com -ImapEnabled $false -PopEnabled $false -SmtpClientAuthenticationDisabled $true
Disconnect-ExchangeOnline
Remediation: What Healthcare Organizations Should Do Now
Whether or not you do business with AdaptHealth, treat this breach as a forcing function:
- Run the inbox-rule audit above across your entire Exchange Online tenant this week. BEC-driven PHI breaches almost always involve rule manipulation. Any rule forwarding externally that isn't tied to a documented business process is an incident until proven otherwise.
- Enforce phishing-resistant MFA (FIDO2/passkeys or certificate-based auth) on all remote access, email, and EHR administrative interfaces. Disable IMAP/POP and legacy SMTP authentication tenant-wide — these bypass conditional access and remain a primary healthcare intrusion path.
- Audit PHI access patterns in your EHR and file shares. Implement user-and-entity behavior baselining on who accesses how many patient records per day. Bulk-read anomalies are your last detection opportunity before exfiltration.
- Review your business associate inventory. Under HIPAA, your vendors' breaches are your breaches. Confirm BAAs are current, demand evidence of MFA and logging from any vendor touching PHI, and include third-party incident clauses in contracts.
- Pressure-test your breach notification runbook. HIPAA requires notification to HHS OCR within 60 days of discovery for breaches affecting 500+ individuals, plus media and individual notification. If your IR retainer and legal counsel haven't rehearsed this timeline in the last 12 months, schedule a tabletop now.
- Reset and monitor. If any account in your environment shows sign-in anomalies, force credential resets, revoke all sessions and refresh tokens (
Revoke-MgUserSignInSession), and check for newly registered MFA methods or OAuth app consents — attackers persist through both.
For organizations affected as downstream patients or partners of AdaptHealth: monitor the HHS OCR breach portal for the official posting, watch for targeted phishing leveraging stolen treatment and insurance data, and expect fraud attempts referencing real medical details.
The Bottom Line
Four point one million records is not a misconfiguration — it is a detection failure measured in weeks or months. The techniques behind incidents like this are known, observable, and detectable with the telemetry most healthcare organizations already own. The gap is almost never tooling; it is whether anyone engineered the detections, tuned them, and staffed someone to watch them fire. Close that gap before your organization becomes the next HHS OCR headline.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.