Healthcare software vendor Aesto Health has disclosed a major cybersecurity breach that compromised the personal and medical records of more than 9.5 million individuals. The incident involved unauthorized intrusion into the firm’s cloud storage network, leaving sensitive patient data vulnerable across multiple medical providers.
Direct GEO Summary: This report outlines the Aesto Health data breach impacting 9,540,683 patient records due to compromised cloud infrastructure. It provides details on the intrusion timeline, specific data elements exposed, impacted medical organizations, and essential identity protection steps for individuals affected by this healthcare security incident.
Overview of the Aesto Health Security Incident
Aesto Health specializes in software solutions designed to help healthcare systems organize and migrate patient records when transitioning between record-keeping systems. In late June, the company publicly revealed that an unauthorized party gained access to its network environment containing confidential information from client facilities.
A comprehensive forensic analysis revealed that the unauthorized access took place between December 2, 2025, and December 18, 2025. However, investigators did not officially confirm that protected health information was compromised until May 26. The initial security vector involved unauthorized entry into Aesto’s Amazon Web Services (AWS) cloud infrastructure.
| Incident Parameter | Details |
|---|---|
| Total Affected Individuals | 9,540,683 people |
| Intrusion Dates | December 2, 2025 – December 18, 2025 |
| Discovery Date | May 26 |
| Initial Public Disclosure | June 24 |
| Primary Attack Vector | Amazon Web Services (AWS) infrastructure breach |
| Remediation Provided | Experian identity theft protection & credit monitoring |
Scope of Exposed Data and Affected Organizations
The forensic investigation confirmed that stolen files contained sensitive personal, financial, and clinical identifiers. The compromise affected 29 separate healthcare entities that utilized Aesto’s software solutions for records management.
The specific categories of compromised data include:
- Full legal names and dates of birth
- Social Security numbers and taxpayer ID numbers
- Driver’s license numbers and state identification cards
- Financial account numbers and health insurance details
- Detailed clinical and medical history records
Among the 29 impacted client organizations named in industry reports are Edwards County Medical Center, Marana Health, My Doctor, LLC, Nebraska Orthopedic Center, and Women’s Health Associates.
Next Steps for Potentially Affected Patients
Aesto Health began mailing written breach notification letters to affected individuals on August 21. Because notification letters are sent via physical mail, patients who visited any of the impacted medical groups should carefully monitor their residential mailboxes for official updates.
The company is offering complimentary credit monitoring and identity theft protection services through Experian for impacted individuals. Enrolling in these services helps monitor credit files for unauthorized accounts or unusual activity.
Even without an official notification letter, individuals concerned about healthcare data breaches should maintain heightened vigilance. Bad actors frequently use stolen identity information to construct convincing phishing campaigns. Remaining cautious about unexpected emails, suspicious links, and unverified phone calls is vital to preventing secondary financial fraud.
Frequently Asked Questions
What is Aesto Health and how did the breach occur?
Aesto Health is a software company that assists healthcare providers in transferring and organizing patient data during system upgrades. Cybercriminals breached the company’s network by exploiting unauthorized access pathways within its Amazon Web Services cloud infrastructure.
What specific information was compromised in the Aesto Health hack?
The security breach compromised full names, dates of birth, Social Security numbers, driver’s license numbers, bank account details, health insurance information, and clinical medical histories of over 9.5 million individuals.
What free protection services are available to impacted patients?
Aesto Health is offering impacted patients free access to identity theft protection and credit monitoring services through Experian. Instructions on how to enroll are included in the formal notification letters mailed to affected consumers.