Aesto Health breach exposes health and identity information of 9.54 million patients
Aesto Health’s December 2025 breach affected 9,540,683 patients through their healthcare providers. Information included health, identity and financial details. Check your notice, use the offered protection and consider freezing your US credit files.
If you receive a notice, ask your healthcare provider which information was involved and follow the letter’s instructions for any free identity protection before its enrolment deadline. Consider freezing your US credit files with Equifax, Experian and TransUnion, and check financial accounts for unfamiliar activity. Report suspicious transactions promptly to your bank.
What’s happening
Aesto Health, which migrates and archives records for healthcare providers, suffered an intrusion into part of its Amazon Web Services infrastructure between 2 and 18 December 2025. It confirmed the potential exposure in May 2026 and publicly disclosed it on 24 June. The breach was later reported to US health regulators as affecting 9,540,683 people. Information varied by patient and included names, dates of birth, medical records, insurance details, Social Security numbers, other government identifiers and financial account numbers. Aesto says it contained the incident when detected. Individual notifications continued into October, with protection services offered through notification letters. Iowa Digestive Disease Center’s September notice says Aesto had no evidence of misuse; that does not establish that exposed information is safe. As at 3 November, the reviewed sources do not establish recovery or deletion of the data, or identify criminal charges. There is no patient software update to apply.
- What
- Breach
- Affects
- Aesto Health healthcare data migration and archiving services
- Fixed in
- Nothing to patch
- Since
- 24 June 2026
Timeline
- Update
An Aesto notification letter for Henry County Hospital patients shows that individual notifications continued into October. It concerns the same December 2025 intrusion.
- Update
Reports confirmed that Aesto’s filing with US health regulators put the affected population at 9,540,683 people.
- Update
BleepingComputer reports that Aesto began sending individual notices, including an offer of 24 months of Experian identity protection and credit monitoring.
- Update
Aesto began notifying healthcare clients whose patients’ information appeared in the potentially affected files.
- Made public
Aesto first publicly disclosed the breach through a notice on its website.
- Update
Following forensic investigation and document review, Aesto confirmed that patient information held for healthcare clients may have been accessed or acquired during the December intrusion.
- Update
Aesto detected unauthorised activity affecting part of its Amazon Web Services infrastructure. Its statement says it immediately contained the incident and brought in cybersecurity investigators.
- UpdateNothing to patch
The intrusion period began around 2 December and ran until 18 December. Aesto later determined that an unauthorised party may have accessed or taken patients’ health information.
Sources
- Notice of Data Security Incident-12-18-25Aesto Health · 24 June 2026
- Henry County Hospital patient notification letterAesto Health, published by the Massachusetts Attorney General · 21 Oct 2026
- Notice of a Data IncidentHealth Access Network, reproducing Aesto Health’s statement · 12 Oct 2026
- Aesto Health says data breach affects over 9.5 million patientsBleepingComputer · 1 Sept 2026
- Aesto Health Data Breach Affects 9.5 Million PatientsHIPAA Journal · 1 Sept 2026
- Notice of Data Security Incident – Aesto HealthIowa Digestive Disease Center · 10 Sept 2026