Aesto LLC, doing business as Aesto Health, has confirmed a data breach exposing the personal and protected health information of 9,540,683 individuals. The Birmingham, Alabama healthcare technology firm reported that figure to the U.S. Department of Health and Human Services' Office for Civil Rights, which added the incident to its public breach portal on Monday, August 31, 2026. The intrusion itself is far older than the disclosure: an unauthorized actor had access to a portion of Aesto's Amazon Web Services environment between approximately December 2 and December 18, 2025, roughly a 16 day window that the company did not fully characterize until May 26, 2026. HIPAA Journal ranks it the second largest confirmed healthcare breach of 2026 to date, behind the 15 million record DentaQuest incident.
What Happened
Aesto Health sells data migration, legacy data archiving, and EHR exchange services to medical practices and healthcare enterprises. When a provider replaces an electronic health record system or absorbs another practice, Aesto holds the old data. That business model is the whole story here: one intrusion at one vendor reached patients belonging to dozens of unrelated covered entities.
The timeline, drawn from the company's own Notice of Data Security Incident and its filing with the California Attorney General's Office:
- December 2 to 18, 2025: An unauthorized third party accesses a limited portion of Aesto's AWS infrastructure.
- On or about December 18, 2025: Aesto detects the unauthorized activity, contains it, secures the affected data center, engages external cybersecurity specialists, and notifies law enforcement.
- May 26, 2026: After what Aesto describes as "an extensive forensic investigation and manual document review," the company confirms that PHI belonging to patients of various Covered Entity clients "may have been accessed and/or acquired."
- June 2026: Aesto posts a public notice. BleepingComputer dates the website notification to June 24; CyberInsider and calHIPAA report that affected healthcare clients began receiving notification on June 26.
- August 21, 2026: Individual notification letters go out, offering 24 months of complimentary identity theft protection and credit monitoring. CyberInsider identifies the provider as Experian IdentityWorks.
- August 31, 2026: HHS posts the 9,540,683 figure.
Note one discrepancy worth flagging. Most sources, including SecurityWeek, Security Affairs, HIPAA Journal, and CyberInsider, place discovery on or about December 18, 2025. BleepingComputer's write up characterizes the breach as "discovered recently" while separately noting the December intrusion and the May 26 internal confirmation. The weight of the reporting, and Aesto's own filings, support December 18, 2025 as the detection date and May 26, 2026 as the date the data impact was confirmed. That still leaves five months between detection and scope determination, and eight months between detection and individual notification.
Accounts also differ on how many downstream providers were hit. HIPAA Journal, publishing the fullest client list, says at least 30. BleepingComputer cites HIPAA Journal for a figure of 29. SecurityWeek and calHIPAA both say "at least two dozen" across several states. Named clients across sources include VillageMD, Everside Health (Marathon Health), Marana Health, Together Women's Health, Ellenville Regional Hospital, Greenwood County Hospital, Graham County Hospital, Henry County Hospital, Little River Memorial Hospital, Edwards County Medical Center, Gila Health Resources, Nebraska Orthopedic Center, Mid-South OB-GYN, and Effingham Obstetrics & Gynecology Associates. Some of those covered entities have elected to notify their own patients directly rather than rely on Aesto.
What Was Taken
The exposed data set is unusually complete, combining identity, financial, and clinical elements in a single record. Aesto's notice and the reporting built on it list:
- Full names
- Dates of birth (HIPAA Journal and calHIPAA specify partial dates of birth; BleepingComputer, SecurityWeek, Security Affairs, and teiss list dates of birth without qualification)
- Social Security numbers
- Driver's license numbers
- State identification numbers and other government issued ID numbers
- Individual taxpayer identification numbers
- Financial account numbers
- Health insurance information
- Medical information, described by HIPAA Journal and calHIPAA in more granular terms as health records, medical histories, and claims and billing data
CyberInsider reports that Aesto characterized Social Security numbers as potentially involved for only a limited number of people. That qualifier appears in only one OTHER tier source and is not corroborated by the outlet reporting, so treat it as the company's framing rather than an established fact. Aesto also states it has found no evidence of identity theft or financial fraud arising from the incident, and teiss notes the company found no indication the data has been misused. Absence of observed misuse eight months after an exfiltration is a weak signal, not an all clear.
Every source that gives a number gives the same one, 9,540,683, sourced to the HHS OCR filing. There is no competing record count in circulation.
Why It Matters
This is a business associate breach, and it demonstrates the asymmetry that makes healthcare data aggregators such attractive targets. Aesto is not a household name. Its patients are not its patients. Yet a single foothold in one AWS tenancy produced a victim population larger than the resident count of most U.S. states, drawn from small rural hospitals, county medical centers, OB-GYN practices, and national primary care chains simultaneously.
Archival data is the specific problem. Aesto's product exists to preserve records from systems that providers have already decommissioned. That means the data sitting in that AWS environment is, by design, historical, comprehensive, and detached from the operational controls of the organizations that generated it. A hospital that migrated off a legacy EHR in 2019 may have had no live visibility into where those records sat in 2025, and no ability to detect the intrusion, and no say in the pace of the investigation. The covered entity carries the HIPAA notification obligation and the reputational damage; the business associate carries the actual risk surface.
The disclosure lag compounds this. Patients whose SSNs, driver's license numbers, taxpayer IDs, and financial account numbers were taken in December 2025 received their letters in late August 2026. For roughly eight months, a complete identity kit was in adversary hands while the affected individuals had no reason to place a credit freeze or watch their benefits statements. Forensic work on unstructured document stores is genuinely slow, and manual document review is a real bottleneck, but the operational effect on victims is the same regardless of the cause.
For defenders, the takeaway is a procurement one as much as a technical one. Vendor questionnaires ask whether a partner encrypts data at rest. They rarely ask how long that partner will take to tell you what was in a compromised bucket.
The Attack Technique
None of the available sources identify a threat actor, a ransomware or extortion brand, or an initial access vector. No group has publicly claimed the data. What the reporting does establish is narrow but useful.
The compromise was confined to what Aesto repeatedly calls "a limited portion" of its AWS infrastructure, and teiss notes the company secured the affected data center as part of containment. Access persisted for roughly 16 days, from December 2 to December 18, 2025, before detection. SecurityWeek and NCIJ Network state the attackers exfiltrated PII and PHI during that window; Aesto's own language is more guarded, saying data "may have been accessed and/or acquired." That gap between the company's hedged phrasing and the press characterization is typical of breach disclosures and worth reading as a legal posture rather than a factual dispute.
Absent an attributed vector, the plausible candidates for a cloud tenancy compromise of this shape are the familiar ones: exposed or overly permissive storage, compromised long lived access keys, a compromised identity with excessive IAM privilege, or a compromised third party integration. Nothing in the public record establishes which. Treat any specific claim about the entry point as unconfirmed until Aesto or a regulator says otherwise.
The 16 day dwell time before detection, and the fact that detection appears to have preceded any public claim or extortion attempt, suggests the activity was noisy enough to surface through monitoring rather than through an attacker announcement. That is a better outcome than many comparable incidents.
What Organizations Should Do
Inventory your legacy data custodians. Every EHR migration, practice acquisition, and system decommission in your organization's history probably left records with a third party. Build the list, confirm what each vendor still holds, and delete what no longer has a retention justification. Data you have successfully archived elsewhere is data that cannot be stolen from you.
Put detection-to-notification timelines in your BAAs. Standard business associate agreements specify breach notification obligations but rarely bind the vendor to a scoping deadline. Contract for interim disclosure: require notice of a confirmed intrusion touching your data within days, with rolling scope updates, rather than one complete answer five months later.
Harden cloud identity before cloud perimeter. For AWS specifically: eliminate long lived IAM user access keys in favor of roles and short lived credentials, enforce MFA on every human principal, scope S3 bucket policies and block public access at the account level, and use Service Control Policies to prevent privilege escalation paths. Most cloud tenancy compromises are identity failures, not exploit chains.
Turn on the logging you will need in month five. Enable CloudTrail across all regions with log file validation, S3 server access logging or data events for buckets holding PHI, GuardDuty, and long retention on all of it. The reason scoping takes five months is usually that the telemetry needed to answer "which records did they read" was never collected.
Alert on bulk read patterns, not just writes. Exfiltration from an archive looks like legitimate access at unusual volume. Baseline normal object read rates per principal and alert on deviation. Sixteen days of sustained collection should be detectable well before day sixteen.
Assume this data set is already in circulation and advise accordingly. Patients of the named provider clients should place credit freezes with all three bureaus rather than relying solely on the 24 month monitoring offer, and should watch Explanation of Benefits statements for care they did not receive. Medical identity theft does not show up on a credit report.
Sources: Aesto Health says data breach affects over 9.5 million patients | 9.5 Million Impacted by Aesto Health Data Breach - SecurityWeek | Aesto Health Data Security Incident Affects Multiple Healthcare Pro... | Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Mill... | Aesto healthcare data breach impacts 9.5 million people | Multiple Healthcare Providers Affected by Aesto Health Data Securit... | 9.5 Million Impacted by Aesto Health Data Breach - NCIJ Network | teiss - News - Aesto Health discloses breach after attackers access...