Third-Party Risk Is No Longer a Vendor Problem. It Is a Data Security Problem

In August 2026, AdaptHealth, a U.S. provider of home medical equipment and supplies, disclosed that personal and health information belonging to more than 4.1 million people had been stolen from its systems. According to the company’s notice to the U.S. Department of Health and Human Services, the data included names, contact and demographic details, and health and health insurance information. The scale is significant, but the more useful lesson for security teams is how the attacker got in.

The attacker did not break through AdaptHealth’s own defenses first. The company says a threat actor used social engineering to compromise a user session at a third-party contractor, then used that session to reach cloud-based applications used for patient management and document storage. For healthcare organizations, the security perimeter now extends to every vendor, contractor, SaaS provider and external identity connected to the business, and to every place the organization’s data has been sent.

The Attack Surface Has Expanded

Healthcare organizations rely on third parties for billing, claims, scheduling, transcription, document management, analytics and, increasingly, AI tools. Each of these relationships means patient data is either shared with the vendor or reachable through the vendor’s access.

That access is usually legitimate. But once a trusted identity or session is compromised, the attacker inherits whatever that identity could see. Multi-factor authentication and awareness training reduce the chance of that happening. They do not change how much sensitive data sits on the other side of the door.

So organizations need to look beyond who has access and ask what data that access exposes, and whether all of it needed to be there.

Visibility Matters More Than Trust Alone

Traditional third-party risk management is built on questionnaires, contract reviews and periodic assessments. These tell you what a vendor says about its own controls. They rarely tell you what data your applications are actually sending to that vendor today.

In practice, that knowledge is scattered. Engineering teams add integrations, business units adopt SaaS tools, and calls to external APIs sit deep in application code. A vendor approved to receive billing codes may, a few releases later, also be receiving diagnoses, dates of birth or free-text clinical notes, and nobody outside the development team knows.

Without a current map of these data flows, organizations know who their vendors are without knowing what those vendors hold.

The Healthcare Data Challenge

Health data is valuable to attackers because it is detailed, difficult to change and usually linked to identity and insurance information. Patient records, insurance details, billing systems and documents are also closely interconnected, so a single compromised third-party session can expose far more than the task that access was created for.

Regulators already expect organizations to limit what they share. HIPAA’s minimum necessary standard, for example, requires covered entities to limit the protected health information they use and disclose to what the purpose requires. Similar purpose-limitation and data-minimization principles appear in India’s Digital Personal Data Protection Act and in data protection laws across the GCC.

Third-party risk is no longer simply a vendor management or compliance issue. It is a data security and visibility challenge.

Five Questions Every Security Team Should Be Able to Answer

1. Which third parties receive our sensitive data? Not only contracted vendors, but every SaaS tool, external API and AI service that our applications and employees send data to.

2. What exactly does each one receive? Which categories of patient and personal data, from which applications, and how often.

3. Does each third party need all of it? Where data is shared beyond what the purpose requires, can it be removed or masked before it leaves?

4. If a vendor is compromised tomorrow, what is our exposure? Which data types and which systems are affected, answered from records rather than guesswork.

5. Can we prove it? Evidence that auditors, regulators and boards can rely on, showing that data sharing is known and controlled.

Moving From Trust to Visibility

The answer is not to stop working with third parties. Healthcare depends on them. The goal is to know, from evidence rather than assumptions, how sensitive data moves between your applications, vendors and AI services, and to control it.

This is where Riscosity, available through SRC Cyber Solutions LLP, helps. Riscosity discovers the third-party and AI services that an organization’s applications and code send data to, identifies the sensitive data in those flows, including health and personal information, and maps which vendor receives what. Security teams can then apply policies that redact or block sensitive data before it leaves, and keep an auditable record of what was shared and with whom.

Riscosity is not a replacement for identity security or awareness training. It addresses the other half of the problem. When each third party receives only the data it needs, and you know exactly what each one holds, a compromised vendor session exposes less and your response starts from facts.

The lesson from this incident is clear: a trusted third party can become an entry point, and a compromised session can become a pathway to sensitive information. Protecting patient data now means looking beyond the organization’s own boundary, knowing where data goes, and making sure every third party receives only what it needs.

Source: SecurityWeek, “4.1 Million Impacted by AdaptHealth Data Breach”, and AdaptHealth’s breach notice to the U.S. Department of Health and Human Services.

ABOUT SRC CYBER SOLUTIONS LLP

SRC Cyber Solutions LLP is a renowned name in India for Cybersecurity. We are known for our exclusive distribution of cutting-edge solutions in India, GCC, Africa and APAC. We take pride in offering a comprehensive suite of Cybersecurity solutions which includes Platforms and Technologies for AI-powered Comprehensive Email Security, Automated Patch and Endpoint Management, Zero Trust Hardware Access, securing the Cloud environments with Hybrid Cloud Workload Protection, enhancing Network Security with Agentless Micro-Segmentation, ensuring Third-Party Data Flow Management and API Management, and Agentless Compliance Management, thereby strengthening our commitment to protecting organizations against evolving known and unknown Cyber Threats. With a focus on embracing innovation, we continuously evolve to meet the dynamic threat landscape, offering a comprehensive range of Next-Gen technologies with a high degree of automation, reducing the dependency on IT Resources and ensuring a strong value proposition.

About Riscosity

Riscosity is an AI and third-party data governance platform. It discovers where sensitive data flows from an organization’s applications, code and employees to third-party services and AI tools, classifies that data, and enforces policies to redact or block it in transit. Security, privacy and compliance teams use Riscosity to see what each vendor and AI service receives, reduce unnecessary exposure, and produce evidence for data protection requirements.