AdaptHealth discovered its breach not from a monitoring alert but from the attacker themselves. A contractor's compromised session had already reached patient management systems, document storage platforms, and external health record portals before anyone noticed. The intrusion began on or around June 5; the company learned about it on June 15 when the threat actor made contact. By then, the personal and health information of 4,115,802 people had been taken.
This wasn't a vulnerability exploit or a ransomware deployment. It was a social engineering attack that compromised an active user session, and the session kept working across multiple systems until someone manually revoked it. The pattern reveals mistakes your team can address today.
Why These Mistakes Keep Happening
Third-party access sits in a control gap. Your organization grants the access and owns the data exposure, but the contractor's employer manages the device, the identity provider, and often the endpoint security posture. That split creates monitoring friction. You're less likely to apply the same session timeout policies, access reviews, or anomaly detection rules to contractor accounts that you apply to your own staff. Meanwhile, attackers know contractor credentials offer broad access with lighter scrutiny.
The AdaptHealth breach demonstrates what happens when session management, access segmentation, and monitoring all fail at once. Each mistake below contributed to the outcome, and each has a specific fix.
Mistake 1: Treating Session Revocation as Optional
Why it happens: Your team resets the password and enables multi-factor authentication, then assumes the problem is solved. But a live session token proves the holder already authenticated, so it continues working until someone explicitly revokes it. Many identity and access management systems don't automatically terminate sessions when you reset credentials.
Real consequence: The attacker maintains access to every system the contractor could reach, even after you've locked the account. In AdaptHealth's case, the compromised session reached cloud business applications, internal patient management systems, document storage, and external health record portals. Resetting the password didn't close those connections.
The fix: Build session revocation into your incident response checklist as a separate action from credential reset. Confirm your identity provider supports immediate session termination across all integrated applications, and verify that terminating the session actually logs the user out of downstream systems. Test this during onboarding, not during an active incident.
Mistake 2: Storing Credentials in General-Purpose Files
Why it happens: Billing staff connect to multiple payer portals, each with unique credentials. Automated processes need those credentials retrievable. Keeping them in a spreadsheet, a shared document, or a billing system file is faster than provisioning a managed credential vault and training staff to use it.
Real consequence: AdaptHealth reported that a stored password file tied to insurance billing was among the files taken. Once an attacker has that file, they can pivot to payer portals, submit fraudulent claims, redirect payments, or access additional patient data held by insurers. The exposure extends beyond your own systems.
The fix: Move all third-party portal credentials into a managed vault that logs access, rotates credentials on a schedule, and integrates with your privileged access management platform. If your billing system requires stored credentials for automation, use service accounts with narrow permissions and rotate them monthly. Never store passwords in documents accessible through compromised sessions.
Mistake 3: Granting Broad Access Without Segmentation
Why it happens: Contractors need access to complete their work, and determining the minimum necessary scope takes time. It's easier to grant access equivalent to a full-time employee in the same role than to map out which specific systems, data sets, and functions the contractor actually needs.
Real consequence: A single compromised session reached patient management systems, document storage, and external health record portals at AdaptHealth. Each additional system multiplies the breach scope. The company told the Securities and Exchange Commission it was unable to determine the full scope of affected data sets or the volume of data involved.
The fix: Create contractor access profiles that default to read-only and grant write access only where documented. Segment access by function: a billing contractor doesn't need document storage, and a records contractor doesn't need insurance portal credentials. Use separate accounts for separate functions, even for the same contractor. This limits what a compromised session can reach and makes forensic scoping faster.
Mistake 4: Relying on Manual Third-Party Access Reviews
Why it happens: You don't have automated tooling that tracks which contractors hold active access, what they can reach, and when their engagement ends. Quarterly access reviews rely on managers remembering to report departed contractors or completed projects. Manual reviews miss accounts that remain active after the business relationship ends.
Real consequence: Research published in Applied Clinical Informatics found that 53% of healthcare organizations that monitor third-party access do it manually, and 58% have not consistently applied access management strategy for third parties. Stale contractor accounts accumulate, each representing a credential an attacker can compromise without triggering alerts tied to current employment verification.
The fix: Implement automated access reviews that flag contractor accounts approaching their documented end date and require manager reauthorization every 90 days. Integrate contractor onboarding and offboarding with your identity management system so access provisioning and deprovisioning happen through workflow, not email requests. Require every contractor account to have a documented business justification, system access list, and expiration date before activation.
Mistake 5: Monitoring Contractor Sessions Like Employee Sessions
Why it happens: Your security information and event management system applies the same behavioral baselines to contractor accounts that it applies to employees. But contractors work irregular hours, access systems from different locations, and may connect through VPNs managed by their employer. Anomaly detection rules tuned for employees generate too many false positives on contractor accounts, so your team stops investigating them.
Real consequence: AdaptHealth discovered the breach when the attacker contacted the company, not from internal monitoring. The compromised session accessed multiple systems over a ten-day period without generating an alert anyone acted on. That gap is what regulators examine separately from the breach itself.
The fix: Create separate monitoring profiles for contractor accounts with tighter thresholds. Flag any contractor session that accesses systems outside their documented scope, downloads large data sets, or connects from a new device. Require contractors to notify your security team before changing their usual access pattern. Accept that you'll investigate more alerts on contractor accounts; that's the cost of granting access to someone whose device and network you don't control.
Prevention Checklist
- Document which contractors hold active access, which systems each can reach, and when access expires
- Confirm your identity provider can revoke sessions separately from resetting passwords, and test the process
- Move all stored credentials for external portals into a managed vault with access logging
- Create contractor access profiles that default to minimum necessary and segment by function
- Implement automated access reviews requiring reauthorization every 90 days
- Build separate monitoring rules for contractor accounts with tighter behavioral thresholds
- Establish a process to verify contractor employment status before granting or renewing access
- Include session revocation, credential vault review, and payer portal inspection in your incident response runbook
The AdaptHealth breach wasn't sophisticated. It was a social engineering attack that worked because session management, credential storage, access segmentation, and monitoring all had gaps. Your team can close those gaps before the attacker makes contact.
