Aesto Health Data Breach Exposes Health and Personal Information of More Than 9.5 Million People

Aesto Health, a U.S. company that manages and transfers data for healthcare organizations and medical practices, has disclosed a breach affecting 9,540,683 individuals. Attackers stole personal and health information from portions of the company’s Amazon Web Services (AWS) infrastructure.

The exfiltration took place from December 2 to 18, 2025. Aesto Health detected the unauthorized activity on December 18, 2025, but the investigation did not determine which categories of information had been compromised until May 26, 2026. The incident was publicly disclosed in June 2026.

The breach was reported to the U.S. Department of Health and Human Services (HHS), which listed Aesto Health in its healthcare data breach portal. The date on which the incident was added to the portal is unknown.

Identifiers, Financial Data, and Medical Information Stolen

The potentially exposed information is particularly sensitive. It includes:

• names;
• Social Security numbers;
• driver’s license numbers;
• other identification numbers;
• dates of birth;
• financial account numbers;
• tax identification numbers;
• medical information;
• health insurance information.

It has not been clarified whether every affected individual had all of these categories exposed. The total of 9,540,683 individuals reflects the overall scope reported to HHS, but it does not show which specific data types were associated with each person.

The combination of personal details, government-issued identifiers, health information, and financial data creates greater risk than a breach limited, for example, to email addresses. These elements can be combined to build convincing victim profiles and bypass verification checks based on personal information.

Potential misuse includes identity theft, fraudulent opening of financial accounts, impersonation, and health insurance fraud. Medical data can also make phishing campaigns more convincing: a message that references a healthcare provider, medical service, or insurance claim is more credible than a generic communication.

However, there are no confirmed reports of fraud, healthcare abuse, or criminal use of the stolen information. It is also unknown whether the data has been published, offered for sale, or shared in criminal forums.

Exfiltration from the AWS Environment Continued Until Detection

According to the investigation’s findings, the attackers exfiltrated data over a 16-day period, from December 2 to 18, 2025. The final day was also when Aesto Health identified the unauthorized activity and began containment efforts.

The company engaged external cybersecurity specialists and reviewed the affected data to identify the individuals and information categories involved. The analysis concluded on May 26, 2026, more than five months after the initial detection.

Several technical details remain unknown. Aesto Health has not disclosed which AWS service was compromised or whether the incident involved storage systems, virtual machines, databases, or other cloud components. The affected configuration has also not been described.

There is likewise no information about the initial access vector. It is unknown whether the attackers used stolen credentials, exposed cloud keys, misconfigurations, phishing techniques, or software vulnerabilities. As a result, the incident cannot be linked to a CVE, an unpatched vulnerability, or a specific security flaw.

No indicators of compromise have been made available, including IP addresses, domains, file hashes, or observable patterns in logs. The identity of the threat actor also remains unknown. There is no confirmation of ransomware or ransom demands.

Aesto Health’s Role Extends the Impact to Its Healthcare Customers

Aesto Health is headquartered in Birmingham, Alabama, and provides healthcare organizations with secure data migration, electronic health record exchange, and legacy archive storage services.

This role explains how a compromise affecting a single provider can impact millions of people. A technology provider that aggregates data from multiple healthcare organizations becomes a common point in the supply chain: access to its environment can expose information belonging to numerous customers, even if their own networks were not directly breached.

The incident affected at least two dozen healthcare customers across several U.S. states. The organizations involved have not been identified, and no geographic breakdown or customer-by-customer count has been made available.

Some providers decided to notify their own patients or members directly rather than leaving the entire process to Aesto Health. As a result, affected individuals may receive communications from different healthcare organizations and at different times.

There is no evidence of a compromise affecting environments outside the identified AWS portions. However, the absence of such confirmation does not prove that the activity was limited to a single resource: without details about the architecture and forensic investigation, the technical scope cannot be reconstructed publicly.

Containment Confirmed, but Technical Remediation Remains Unknown

Aesto Health says it contained the incident shortly after detection, launched an investigation, and engaged external experts. It subsequently analyzed the affected data, notified HHS, and began sending the required notifications to affected parties.

The company has not described the measures taken within the AWS environment. It is unknown whether Aesto Health rotated keys, tokens, and credentials; modified cloud permissions; isolated accounts; corrected configurations; or introduced additional monitoring controls.

No patch has been announced because no software vulnerability has been publicly identified. There is also no information about whether credit monitoring or identity theft protection services are being offered.

For healthcare customers, the first step is to determine which datasets passed through or remained in the compromised environment. They must then map that data to affected individuals, preserve evidence, and investigate any anomalous access during the exfiltration period.

From a technical perspective, organizations should review available AWS logs, including changes to identities, permissions, and access policies. They should also investigate unusual downloads, high-volume transfers, authentications from atypical locations, and the creation of new credentials. These are recommended defensive measures, not actions Aesto Health has confirmed it took.

What Potentially Affected Individuals Should Do

Anyone who receives a notification from Aesto Health or one of its healthcare customers should read it carefully to determine which categories of personal data are associated with their case. Individuals should not assume that every listed type of information was stolen from every victim.

It is advisable to monitor financial transactions, credit applications, tax-related communications, and health insurance activity. Unknown medical services, changes to insurance information, or unexpected payment requests may indicate misuse of the exposed data.

Exercise particular caution with emails, phone calls, and messages that reference the incident. A criminal may impersonate Aesto Health, a clinic, an insurer, or an identity protection service. Requests for passwords, one-time codes, full Social Security numbers, or urgent payments should be treated as suspicious.

Verify communications by contacting the organization through independently sourced contact details rather than using links or phone numbers included in unexpected messages. Where possible, enable multi-factor authentication and replace credentials reused across multiple services.

The scale of the breach is confirmed; its subsequent exploitation is not currently known. However, the variety of stolen data requires long-term monitoring: personal identifiers and health information remain useful for far longer than a password that can be changed.