Aesto Health Reports Breach Affecting 9.54 Million People
Summary
Aesto Health says unauthorized access to part of its AWS infrastructure may have exposed patient information affecting 9,540,683 people. The intrusion occurred in December 2025 and affected patients linked to 29 healthcare providers.
Key points
- Aesto Health said the intrusion occurred between December 2 and 18, 2025, and was confirmed internally on May 26, 2026, after an external forensic investigation.
- The company reported 9,540,683 affected individuals to the U.S. Department of Health and Human Services.
- Potentially accessed data included names, birth dates, medical and insurance information, Social Security numbers, and financial account details.
- The incident indirectly affects patients of 29 healthcare providers, including VillageMD, Everside Health, Marana Health, and Together Women’s Health.
- Aesto Health began notifying affected individuals on August 21 and is offering 24 months of identity theft protection and credit monitoring through Experian.
- No threat groups had publicly claimed the attack at the time of the article.
Article Details
- Victim Organization
- Aesto Health (Aesto LLC)
- Incident Type
- Unauthorized access to a portion of Aesto Health’s Amazon Web Services infrastructure. The intrusion occurred from 2025-12-02 to 2025-12-18.
- Incident Date
- 2025-12-02
- Disclosure Date
- 2026-06-24
- Data Types Exposed
- Full names
- Dates of birth
- Medical information
- Driver’s license numbers
- Financial account numbers
- Health insurance information
- Individual taxpayer identification numbers
- Other government identification numbers
- Social Security numbers
- Affected Records
- 9,540,683 individuals
- Operational Impact
- The article does not report operational disruption. Aesto Health said patient information belonging to patients of multiple covered-entity clients may have been accessed and/or acquired.
- Ransom Or Extortion
- No threat groups had publicly claimed the attack at the time of reporting; ransom or extortion activity was not reported.
- Claim Status
- confirmed
Vendors
Aesto HealthAesto Health disclosed a data breach affecting more than 9.5 million people after unauthorized access to a portion of its Amazon Web Services infrastructure exposed sensitive patient information.Amazon Web ServicesAesto Health disclosed a data breach affecting more than 9.5 million people after unauthorized access to a portion of its Amazon Web Services infrastructure exposed sensitive patient information.ExperianThe incident may have impacted patients linked to multiple healthcare providers, and the company is offering 24-month identity theft protection and credit monitoring through Experian.