Aesto Health Breach: 9.5M Patients and the Vendor Problem

Aesto Health, a Birmingham, Alabama company that migrates and archives old electronic health records for medical practices, has reported a breach affecting 9,540,683 people to the U.S. Department of Health and Human Services, according to HIPAA Journal and BleepingComputer. An unauthorized actor was inside part of Aesto's Amazon Web Services environment from December 2 to December 18, 2025, yet individual notification letters did not start going out until August 21, 2026, BleepingComputer reports. Most of them have likely never heard of Aesto. That is the vendor problem in healthcare, and this breach shows it clearly.

The thesis of this piece is simple. Healthcare's weakest link is often not the hospital, but the companies that hold the hospital's data after the hospital has stopped paying attention to it. Aesto's business is legacy data: the records left behind when a practice switches electronic health record (EHR) systems or acquires another clinic. Those archives are large, rarely touched, and full of the identifiers criminals value most. Below: what happened, why the timeline stretched to eight months, what affected patients can do this week, and what providers should put in their vendor contracts before the next one.

What happened in the Aesto Health breach?

According to Aesto's own notice of data security incident, the company detected an intrusion affecting its Amazon Web Services infrastructure on December 18, 2025. After a forensic investigation with outside cybersecurity specialists, Aesto confirmed on May 26, 2026 that protected health information belonging to patients of its "Covered Entity clients" may have been accessed or acquired between December 2 and December 18, 2025. Aesto says it contained the incident immediately and that it has found no evidence of identity theft or financial fraud.

The exposed data, per Aesto's notice, includes:

• Full names and dates of birth
• Medical information and health insurance information
• Driver's license numbers and other government identification numbers
• Financial account numbers
• Individual taxpayer identification numbers (ITINs)
• Social Security numbers (Aesto says this applies to a limited number of individuals)

The 9,540,683 figure comes from Aesto's filing with the HHS Office for Civil Rights, as reported by HIPAA Journal and BleepingComputer. HIPAA Journal ranks it as the second-largest confirmed healthcare data breach of 2026 so far, behind a 15 million record breach at DentaQuest. As of BleepingComputer's September 1 report, no ransomware or extortion group had publicly claimed the attack.

Who is affected, and why have most of them never heard of Aesto?

Aesto sells to healthcare organizations, not patients. Its website pitches "Healthcare Data Migration|Archive|Access" under the tagline "Simplifying the Exchange of Healthcare Data," aimed at multi-site operators that need to manage legacy data during EHR transitions and facility acquisitions. Products include a DataCapture platform, a patient accounting archive and clinical history tools.

That makes Aesto a HIPAA "business associate": a company that handles protected health information on behalf of a healthcare provider (the "covered entity"). The patients whose records were exposed had a relationship with their clinic, not with Aesto. Many will learn about the vendor only when a letter arrives.

How many providers are involved depends on who is counting:

Source	Provider clients affected	Notes
Aesto's covered-entity notice page	28 named	Includes rural hospitals, community health centers and specialty groups such as Graham County Hospital, Marana Health and Texas Spine Consultants
BleepingComputer (Sept. 1, citing HIPAA Journal)	29	Names VillageMD, Everside Health (Marathon Health), Marana Health and Together Women's Health
HIPAA Journal	At least 37	Its list includes Village Practice Management and Everside Health, neither of which appears on Aesto's own page

The gap is itself a finding. Under HIPAA, the covered entity owns the notification duty, so some providers file under their own name and some let the vendor file for them. State attorney general databases show the same split. Washington's attorney general lists three Aesto-linked entries as of September 2026: Everside Health covering 21,308 Washington residents, Grant County Public Hospital District #2 covering 37,253, and Nebraska Orthopaedic Center covering 992. California's attorney general lists a filing for Together Women's Health, sent by "Aesto LLC, on behalf of Together Women's Health LLC." A patient trying to work out whether they are affected has to search under the clinic's name, the vendor's name, or both.

Why did it take eight months to notify patients?

This is the part that deserves the most scrutiny. Here is the timeline from Aesto's notice and BleepingComputer's reporting:

Date	Event
December 2–18, 2025	Unauthorized access window in Aesto's AWS environment
December 18, 2025	Aesto detects the intrusion
May 26, 2026	Forensic review confirms protected health information may have been accessed
June 24, 2026	Aesto first discloses the incident publicly on its website, per BleepingComputer
June 26, 2026	Aesto begins notifying its healthcare clients, per its notice
August 21, 2026	Individual notification letters begin

From detection to the first patient letters: 246 days. The HIPAA Breach Notification Rule requires a business associate to notify the covered entity "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (45 CFR 164.410). Covered entities then have the same 60-day outer limit to notify individuals (45 CFR 164.404).

Measured from the May 26 forensic confirmation, Aesto's client notice came about a month later. Measured from the December 18 detection, it came more than six months later. Which date counts is a legal question for regulators. The rule treats a breach as discovered on the first day it is known, or would have been known with reasonable diligence. What matters for operators is the pattern. Vendor breaches often spend months in a gap between "we saw something" and "we confirmed patient data was involved." During that gap, the providers whose patients are exposed often know nothing, and the patients certainly know nothing.

Aesto's notice calls its investigation "extensive" but does not say why it took until late May. Scale is a likely factor. A migration and archiving vendor holds data for many clients, often in formats inherited from retired systems. Working out which records belonged to which provider, and which fields were in each file, is slow and expensive. That explanation is plausible, and it is also why the risk sits with the vendor model itself.

Why is the vendor model so risky for healthcare?

The Aesto breach is not an outlier. Writing in MedCity News on August 11, before the Aesto numbers were public, Katie Adams reported that vendors processing claims, billing and records on providers' behalf accounted for six of 2026's ten largest healthcare breaches. Three structural reasons explain why:

1. Aggregation. One vendor serving dozens of clinics creates one target holding millions of records. A small rural hospital would never store 9.5 million patient files. Its archive vendor does, across every client.
2. Stale data. Legacy archives exist because providers must keep records after they retire an EHR. Nobody looks at that data daily, so unusual access is less likely to be spotted, and nobody has an operational reason to delete it.
3. Certification is not the same as security. Aesto states on its website that it holds HITRUST r2 certification and a SOC 2 Type 2 attestation. Those are meaningful audits, and procurement teams rely on them. They also measure controls over a set period. They do not guarantee a breach won't happen, and buyers should not treat them as a substitute for their own ongoing oversight.

The AWS detail matters less than headlines suggest. Under Amazon's shared responsibility model, AWS secures the underlying infrastructure, while customers are responsible for "security in the cloud," including their data, identity and access management, and encryption settings. Nothing in the public record says AWS itself was compromised. Aesto describes "a limited portion" of its own AWS environment being accessed. How the attacker got in has not been disclosed.

This is the same pattern VentureBeast.Tech has flagged as more of healthcare moves to third parties, from ambient clinical AI scribes that process visit audio to hospital-at-home platforms that stream patient data from living rooms. Every new vendor is another place patient data lives, and another contract that decides how fast you hear about a problem.

What should you do if you got an Aesto breach letter?

The exposed fields include Social Security numbers, government IDs, financial account numbers and insurance details. That combination supports both financial identity theft and medical identity theft (someone using your insurance to get care or prescriptions). These steps are free:

1. Verify the letter, then call the response line. Aesto's notice lists a toll-free line at 833-918-8060, Monday to Friday, 8 a.m. to 8 p.m. Central, excluding holidays. Have the engagement number from your letter ready. If a message asks you to click a link or pay anything, treat it as a likely scam.
2. Enroll in the monitoring offer in your letter. Reports differ on the details. BleepingComputer reported 24 months of Experian credit monitoring, while teiss reported monitoring through Epiq. Offers may vary by provider, so use the code and deadline printed on your own letter.
3. Freeze your credit at all three bureaus. The Federal Trade Commission says a freeze costs nothing to place or lift, does not affect your credit score, and lasts until you lift it. You must contact Equifax, Experian and TransUnion separately.
4. Or place a fraud alert. An initial fraud alert lasts one year and needs only one bureau, which tells the other two. Identity theft victims can get an extended alert that lasts seven years.
5. Get an IRS Identity Protection PIN. Because taxpayer ID numbers were among the exposed fields, this one matters. The IRS IP PIN is a six-digit number that stops anyone else filing a tax return with your SSN or ITIN. It is valid for one calendar year and renews each year.
6. Read your Explanation of Benefits statements. Aesto's notice recommends this, and it is the main way to catch medical identity theft. Look for visits, prescriptions or equipment you did not receive, and report them to your insurer.

Keep in mind that a credit freeze does nothing for medical records. Unlike a card number, a diagnosis can't be cancelled and reissued. That permanence is why health data breaches have longer consequences than retail ones, a point we made in our coverage of at-home genomics and DNA data privacy.

What should healthcare providers demand from data vendors?

HIPAA sets a floor. A business associate agreement (the contract HIPAA requires between a provider and a vendor that handles patient data) must require breach reporting, but the rule's 60-day outer limit starts at "discovery." That word is doing a lot of work. Providers have leverage at contract signing and renewal, and they should use it. Based on the Aesto timeline, these are the terms we would push for:

Contract term	HIPAA floor	What to demand
Incident notice	Breach notice without unreasonable delay, 60 days maximum after discovery	Notice of a suspected security incident touching your data within days of detection, not after forensics finish
Definition of discovery	First day known, or would have been known with reasonable diligence	Discovery defined as the date of detection, written into the contract
Investigation updates	Provide information as it becomes available	Scheduled status updates during forensics, including which of your record sets are in scope
Data retention	Return or destroy PHI at contract end where feasible	Documented purge schedules for archived data past its legal retention period, with certificates of destruction
Encryption and access	Use appropriate safeguards (45 CFR 164.504)	Encryption at rest with keys scoped per client, and access logs you can request
Cost of notification	Not specified	Vendor pays for notification, call centers and monitoring when its systems are the breach source

The retention row is the most underrated. An archive vendor holds data precisely because nobody wants to deal with it. Every record kept past its required retention period is exposure with no clinical value. Providers should know, by record type and by vendor, what they are still paying someone to keep, and why.

What to watch next

Three things will show how seriously this gets treated. First, whether more providers file their own notices, pushing the client count higher than HIPAA Journal's 37. Second, whether the HHS Office for Civil Rights opens an investigation into the gap between December detection and August letters. Third, whether provider procurement teams actually change their vendor contracts, or file this away with the other vendor breaches of 2026.

The bottom line: if you run a practice, the Aesto breach is a prompt to list every vendor holding your patients' records, including the archive you stopped thinking about after your last EHR migration. If you received a notice, a credit freeze and an IRS IP PIN are the two free steps worth taking first.

Frequently Asked Questions

How many people were affected by the Aesto Health data breach?

Aesto Health reported 9,540,683 affected individuals to the HHS Office for Civil Rights, according to HIPAA Journal and BleepingComputer. The records came from patients of healthcare providers that used Aesto to migrate or archive electronic health records. HIPAA Journal described it as the second-largest confirmed healthcare data breach of 2026 at the time of its report.

What information was exposed in the Aesto breach?

According to Aesto's notice, exposed data includes full names, dates of birth, medical information, health insurance information, driver's license numbers, individual taxpayer identification numbers, other government ID numbers, financial account numbers and, for a limited number of people, Social Security numbers. Aesto says it has found no evidence of identity theft or fraud.

Why did I get a letter from a company I've never used?

Aesto is a business associate: it stored or migrated records on behalf of your doctor's office, hospital or clinic, often after that provider switched EHR systems. You had a relationship with the provider, not with Aesto. Letters may come from Aesto on the provider's behalf, or from the provider directly.

Is a credit freeze enough protection after a health data breach?

No. A freeze blocks new credit accounts, but it does not stop medical identity theft or tax fraud. Pair it with an IRS Identity Protection PIN, because taxpayer ID numbers were exposed, and review the Explanation of Benefits statements from your insurer for care you did not receive. Report anything unfamiliar to your insurer promptly.

Was Amazon Web Services hacked?

No public evidence says so. Aesto describes unauthorized access to a limited portion of its own AWS environment. Under AWS's shared responsibility model, Amazon secures the underlying cloud infrastructure, while customers such as Aesto are responsible for their data, access permissions and encryption. Aesto has not disclosed how the attacker gained access.