Aesto Health breach hits 9.5 million patient records
Aesto Health told HHS that 9,540,683 people are in a breach that ran 2 to 18 December 2025 on a slice of AWS. Stolen fields include SSNs, driver's licenses, medical and insurance data. HIPAA Journal counted 29 provider clients. No public threat-group claim as of 1 September.
Aesto Health told federal health officials that 9,540,683 people had their records stolen from a slice of the company's Amazon cloud. The Birmingham, Alabama vendor migrates electronic health records, runs exchanges, and archives leftover files for hospitals. SecurityWeek reported the company was added to the HHS breach portal on the Monday before that 1 September write-up.
The company has not confirmed ransomware, and no named crew had claimed the attack as of that 1 September coverage. What it confirmed is an AWS break-in, reported through an HHS portal filing and the trade press.
Aesto's June notice said it found unauthorized activity on 18 December 2025 in a limited portion of its AWS infrastructure, contained it, and hired outside experts. On 26 May 2026 the investigation concluded that attackers took PII and PHI between 2 and 18 December 2025. The public website notice went up 24 June. Individual notices started 21 August, with 24 months of Experian identity theft protection and credit monitoring.
The stolen fields, per the company and the HHS filing, include names, Social Security numbers, driver's license numbers, other ID numbers, dates of birth, financial account numbers, medical information, health insurance information, and taxpayer ID numbers. That is a full identity-plus-clinical bundle, not a shallow contact list.
HIPAA Journal counted 29 healthcare provider clients in the cascade, among them VillageMD, Everside Health (Marathon Health), Marana Health, and Together Women's Health, BleepingComputer reported. SecurityWeek said at least two dozen clients across several states were affected, with some providers sending their own notices. The 29 figure is HIPAA Journal's tally, not proof every named client's full EHR was dumped.
The path is a healthtech data-migration vendor, not the hospital's own records system, the same third-party pattern as the Manchester Airports Group customer-data incident.
Some offers on this page may be paid placements or contain affiliate links.
Cyberpresso: daily cyber & AI brief
Free daily newsletter, read in 5 minutes.
Subscribe free