AdaptHealth (AHCO) said Thursday it is investigating a material cybersecurity incident in which a threat actor gained unauthorized access to company systems and exfiltrated certain data.

The company said it determined the incident was material on June 27 due to the nature and potential volume of data at risk.

AdaptHealth said the threat actor accessed certain cloud-based business applications, including internal patient management systems and document storage platforms. It confirmed that a stored password file associated with insurance billing was exfiltrated and that certain external electronic health record system portals were accessed.

Affected data includes insurance billing passwords and certain personally identifiable and protected health information. The company said the affected systems do not contain Social Security numbers, financial account information or payment card information.

The company added that the incident has been contained and has not had a material impact on operations or its ability to serve patients.