{"id":"aesto-health-patient-breach-jun-2026","category":"breach","status":"live","title":"Aesto Health breach exposes health and identity information of 9.54 million patients","tldr":"Aesto Health’s December 2025 breach affected 9,540,683 patients through their healthcare providers. Information included health, identity and financial details. Check your notice, use the offered protection and consider freezing your US credit files.","summary":"Aesto Health, which migrates and archives records for healthcare providers, suffered an intrusion into part of its Amazon Web Services infrastructure between 2 and 18 December 2025. It confirmed the potential exposure in May 2026 and publicly disclosed it on 24 June. The breach was later reported to US health regulators as affecting 9,540,683 people. Information varied by patient and included names, dates of birth, medical records, insurance details, Social Security numbers, other government identifiers and financial account numbers. Aesto says it contained the incident when detected. Individual notifications continued into October, with protection services offered through notification letters. Iowa Digestive Disease Center’s September notice says Aesto had no evidence of misuse; that does not establish that exposed information is safe. As at 3 November, the reviewed sources do not establish recovery or deletion of the data, or identify criminal charges. There is no patient software update to apply.","action":"If you receive a notice, ask your healthcare provider which information was involved and follow the letter’s instructions for any free identity protection before its enrolment deadline. Consider freezing your US credit files with Equifax, Experian and TransUnion, and check financial accounts for unfamiliar activity. Report suspicious transactions promptly to your bank.","product":"Aesto Health healthcare data migration and archiving services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["aesto-health","healthcare","data-breach","patient-records","identity-theft","us"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notice of Data Security Incident-12-18-25","url":"https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/","by":"Aesto Health","date":"2026-06-24"},{"kind":"advisory","title":"Henry County Hospital patient notification letter","url":"https://www.mass.gov/doc/2026-1845-henry-county-hospital/download","by":"Aesto Health, published by the Massachusetts Attorney General","date":"2026-10-21"},{"kind":"advisory","title":"Notice of a Data Incident","url":"https://hanfqhc.org/notice-of-a-data-incident/","by":"Health Access Network, reproducing Aesto Health’s statement","date":"2026-10-12"},{"kind":"news","title":"Aesto Health says data breach affects over 9.5 million patients","url":"https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/amp/","by":"BleepingComputer","date":"2026-09-01"},{"kind":"news","title":"Aesto Health Data Breach Affects 9.5 Million Patients","url":"https://www.hipaajournal.com/aesto-health-data-breach/","by":"HIPAA Journal","date":"2026-09-01"},{"kind":"advisory","title":"Notice of Data Security Incident – Aesto Health","url":"https://iddc.net/notice-of-data-security-incident-aesto-health/","by":"Iowa Digestive Disease Center","date":"2026-09-10"}],"started":"2026-06-24","closed":null,"created":"2026-11-03T20:21:48.835Z","updated":"2026-11-03T20:21:48.835Z","cve_notes":[],"timeline":[{"at":"2026-10-21","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"An Aesto notification letter for Henry County Hospital patients shows that individual notifications continued into October. It concerns the same December 2025 intrusion.","url":"https://www.mass.gov/doc/2026-1845-henry-county-hospital/download","by":"Aesto Health, published by the Massachusetts Attorney General","patch":null},{"at":"2026-09-01","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Reports confirmed that Aesto’s filing with US health regulators put the affected population at 9,540,683 people.","url":"https://www.hipaajournal.com/aesto-health-data-breach/","by":"HIPAA Journal","patch":null},{"at":"2026-08-21","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"BleepingComputer reports that Aesto began sending individual notices, including an offer of 24 months of Experian identity protection and credit monitoring.","url":"https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/amp/","by":"BleepingComputer","patch":null},{"at":"2026-06-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Aesto began notifying healthcare clients whose patients’ information appeared in the potentially affected files.","url":"https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/","by":"Aesto Health","patch":null},{"at":"2026-06-24","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Aesto first publicly disclosed the breach through a notice on its website.","url":"https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/amp/","by":"BleepingComputer","patch":null},{"at":"2026-05-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Following forensic investigation and document review, Aesto confirmed that patient information held for healthcare clients may have been accessed or acquired during the December intrusion.","url":"https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/","by":"Aesto Health","patch":null},{"at":"2025-12-18","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Aesto detected unauthorised activity affecting part of its Amazon Web Services infrastructure. Its statement says it immediately contained the incident and brought in cybersecurity investigators.","url":"https://hanfqhc.org/notice-of-a-data-incident/","by":"Health Access Network, reproducing Aesto Health’s statement","patch":null},{"at":"2025-12-02","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The intrusion period began around 2 December and ran until 18 December. Aesto later determined that an unauthorised party may have accessed or taken patients’ health information.","url":"https://www.aestohealth.com/notice-of-data-security-incident-12-18-25/","by":"Aesto Health","patch":"na"}],"url":"https://hard.fyi/live/aesto-health-patient-breach-jun-2026/","json":"https://hard.fyi/api/live?id=aesto-health-patient-breach-jun-2026"}