Aesto Health, a Birmingham, Alabama healthcare data-migration and archiving provider, says an unauthorized party accessed a limited Amazon Web Services environment between December 2 and December 18, 2025. Forensic work confirmed the incident on May 26, 2026, and the US Department of Health and Human Services breach census later reached 9,540,683 individuals, according to BleepingComputer. Aesto published notice around June 24, downstream notifications followed, and patient letters began on August 21, 2026.
What happened in the Aesto Health AWS environment
Aesto provides software and services used to migrate, convert, archive, and access healthcare information. That work can place the company in possession of historical patient data from hospitals, physician groups, and other covered entities even when patients have never interacted directly with Aesto.
The company’s incident notice says the unauthorized activity was limited to a portion of its AWS infrastructure. The access window ran for more than two weeks in December 2025. Aesto investigated with external specialists and determined on May 26, 2026 that protected information had been involved.
The public notice does not identify the attacker, initial-access method, or a ransomware group. There is no factual basis to describe the Aesto Health data breach as ransomware unless the company or investigators release additional evidence. The confirmed issue is unauthorized access to a limited cloud environment containing data handled for healthcare customers.
Why the HHS count is so large
The HHS Office for Civil Rights census of 9,540,683 people reflects Aesto’s role as a business associate serving many healthcare organizations. A single archive or migration vendor can hold records from numerous providers, allowing one cloud incident to propagate across an otherwise unrelated set of covered entities.
Reported downstream organizations include VillageMD, Marathon Health or Everside Health, Marana Health, Together Women’s Health, and additional provider clients. The complete affected-provider list and patient count for each organization may differ as notifications continue.
A person may receive a letter bearing Aesto’s name, a healthcare provider’s name, or both. That does not necessarily mean the provider’s live clinical network was compromised. In many cases, the exposed material was held in an Aesto-hosted migration or archive environment.
The incident timeline
- December 2, 2025: The unauthorized access to the limited AWS environment began.
- December 18, 2025: The identified access window ended.
- May 26, 2026: Forensic investigation confirmed that personal and protected health information was involved.
- Around June 24, 2026: Aesto’s public notice became available and provider notification activity expanded.
- July and August 2026: Downstream healthcare organizations issued notices or prepared patient mailings.
- August 21, 2026: Aesto began mailing patient letters associated with the broader incident.
- Around September 1, 2026: Reporting based on the HHS portal identified 9,540,683 affected individuals.
The months between December access and May confirmation demonstrate the difficulty of investigating archived healthcare data. A vendor must first establish what the attacker reached, then map files to customers, identify individuals, determine which fields applied to each person, and coordinate notices across state and federal requirements.
Complexity does not erase the harm caused by delay. Patients cannot take protective action until they know their records may be involved. Healthcare vendors should design archives so that access logging and customer-level inventories can answer those questions quickly.
What personal and health information was exposed
Depending on the affected provider and individual, the information may include names, dates of birth, medical information, driver’s-license numbers, financial account numbers, health-insurance information, taxpayer identifiers, government identification numbers, and Social Security numbers.
Medical information can include details connected to treatment, diagnosis, procedures, claims, billing, or patient history. Public notices generally describe categories rather than every database field, and no individual should assume that the entire list applies to their record. The mailed notice is the best source for person-specific categories when it provides them.
The combination is especially sensitive. A name and Social Security number can support financial identity theft. Add insurance information, medical history, and a driver’s license, and a criminal may be able to impersonate a patient, submit fraudulent claims, open accounts, or craft highly credible calls about real healthcare relationships.
Why archived healthcare data remains valuable
Healthcare organizations often retain records for legal, clinical, billing, and continuity-of-care reasons. A migration vendor may preserve information from retired electronic health record systems so that providers can retrieve it without operating obsolete software.
Archived does not mean harmless. A diagnosis from years ago remains private. A Social Security number and birth date remain useful for identity theft. Historical insurance and provider information can help a scammer identify the exact organization a patient trusts.
Archives can also receive less operational attention than live clinical systems. They may be accessed infrequently, rely on long-lived service credentials, or sit outside everyday monitoring. Attackers understand that an old-data repository may contain a broad patient population with fewer safeguards around bulk access.
Who may be affected
The exposed population includes patients whose information Aesto maintained for downstream covered entities. It may also include guarantors, insurance subscribers, or other people referenced in healthcare records. Receiving care from an affected practice does not automatically mean every person’s information appeared in the AWS environment.
Former patients should remain alert. Migration and archive services exist precisely because organizations must preserve older information. A patient who changed doctors, moved, or stopped using a healthcare group years ago can still appear in retained records.
Parents and caregivers should review letters addressed to children, dependents, or deceased relatives. Minor identity theft can remain undetected for years because children rarely use credit. A deceased person’s identifiers can also be misused for tax, insurance, or benefits fraud.
Medical identity theft creates distinct harms
Financial fraud is only one risk. Medical identity theft occurs when someone uses another person’s identity or insurance information to obtain care, prescriptions, equipment, or reimbursement. Fraudulent activity can produce bills and collection notices, but it may also place incorrect information in a medical record.
An inaccurate allergy, diagnosis, blood type, or medication history can create patient-safety problems. Healthcare identity victims should not only dispute charges; they should ask providers and insurers whether unfamiliar services changed their clinical or claims records.
Privacy rules may make record correction slower than canceling a payment card. Patients should document every conversation, request written explanations, and keep copies of corrected records. If information cannot legally be deleted, ask that the record clearly identify disputed fraudulent entries.
Phishing will exploit trusted provider names
Many patients do not recognize Aesto Health. A scammer can exploit that confusion by claiming to represent VillageMD, Marathon Health, Everside, Marana Health, Together Women’s Health, Experian, HHS, or another familiar provider. The caller may know a real date of birth or insurance detail.
Common lures include free monitoring enrollment, a medical refund, an unpaid balance, a new insurance card, or urgent verification of benefits. A legitimate organization should not require a one-time banking code, cryptocurrency payment, gift card, remote-access application, or full online-banking password.
Do not click a link solely because a message references the Aesto breach. Use the number printed on a verified mailed letter or navigate to an organization’s official website independently. Be cautious of sponsored search advertisements that imitate breach-response pages.
What the Experian monitoring offer provides
Aesto is offering 24 months of Experian credit monitoring and identity-protection services to eligible individuals. The assistance number is 833-918-8060. Recipients should verify enrollment instructions against the official notice before providing personal information.
Two years of monitoring is useful because it can alert users to certain changes on a credit file. It is not a complete remedy. Medical claims, tax filings, government benefits, bank-account takeover, and many forms of synthetic identity fraud may not immediately produce a credit alert.
Monitoring works best alongside security freezes, careful review of insurer statements, strong account authentication, and prompt investigation of unfamiliar correspondence. Victims should keep the enrollment confirmation and note when protection expires.
What affected patients should do now
- Confirm whether the letter is genuine. Compare it with the official Aesto notice or call 833-918-8060 using independently verified information.
- Enroll in the 24-month Experian service. Complete enrollment before the stated deadline and save confirmation. Do not pay anyone who claims an enrollment fee is required.
- Freeze your credit reports. Place free freezes with Equifax, Experian, and TransUnion. A freeze can prevent many creditors from opening an account while monitoring can alert you to attempted activity.
- Review credit reports carefully. Look for unfamiliar inquiries, addresses, employers, loans, utility accounts, or collections. Dispute errors with both the credit bureau and the reporting business.
- Inspect explanations of benefits. Check insurer portals and mailed statements for providers, treatments, prescriptions, equipment, or locations you do not recognize.
- Request medical records when fraud appears. Ask the relevant provider for an accounting and correction process. Make clear that identity theft may have introduced inaccurate clinical information.
- Protect tax identity. Consider an IRS Identity Protection PIN and secure official tax accounts. Respond promptly to notices about returns or income you do not recognize.
- Secure financial and email accounts. Use unique passwords, strong multifactor authentication, transaction alerts, and a mobile-carrier PIN. Email protection is critical because password resets flow through the inbox.
- Protect children and dependents. Consider child credit freezes where available and retain notices for future reference. Watch for benefit or tax correspondence involving a dependent.
- Document all losses. Keep letters, claim statements, police or identity-theft reports, postage receipts, and time spent resolving fraud. Detailed records help with disputes and reimbursement claims.
What healthcare providers should tell patients
Downstream providers should explain whether the incident occurred in their own environment or in Aesto’s archive. Clear language prevents patients from incorrectly assuming that live medical systems, current passwords, or every clinical record were compromised.
Provider notices should identify the relationship with Aesto, the relevant retention period, the data categories for that provider, and whom patients should contact about inaccurate medical records. Sending people only to a generic credit-monitoring center leaves medical identity questions unanswered.
Practices should prepare frontline staff for calls. Billing, records, privacy, and clinical teams need a consistent escalation path for suspicious claims or corrupted medical information. Patients should not have to explain the breach from the beginning to every department.
Cloud security lessons from the Aesto breach
AWS provides security controls, but customers remain responsible for identities, permissions, logging, application design, and data governance. Describing the incident as an AWS breach would wrongly imply that the underlying cloud provider was compromised. Aesto’s notice concerns unauthorized access to its environment hosted on AWS.
Healthcare archives should separate each customer’s data and prevent a single credential from reading a multi-provider repository. Access should be time-limited, purpose-bound, and monitored for unusual volumes. Administrative identities need phishing-resistant authentication and should not rely on reusable access keys.
Immutable audit logs must exist outside the environment an attacker can alter. Alerts should detect bulk reads, unusual archive restoration, access from new infrastructure, and large outbound transfers. Encryption is necessary but insufficient when a compromised workload or account can legitimately decrypt records.
Secret management also matters during migrations. Temporary credentials and broad permissions created to move data can become permanent through neglect. Every migration should end with credential revocation, permission reduction, integrity checks, and documented deletion of unnecessary staging copies.
Data minimization is a patient-safety control
Healthcare retention laws can require long storage periods, but not every field must remain in every system. Vendors and covered entities should map each category to a legal or operational purpose. Duplicate staging files, outdated exports, and unnecessary identifiers should be deleted securely.
Where information must be preserved, organizations can tokenize direct identifiers, separate clinical content from identity keys, and restrict re-identification to specific workflows. These controls reduce the number of systems where one intrusion yields a complete identity package.
Contracts should specify deletion, return, and verification procedures when a provider leaves the service. A withdrawn customer should not discover years later that redundant patient copies remained accessible in a shared archive without a documented need.
Business-associate oversight cannot be paperwork only
HIPAA business-associate agreements establish obligations, but contractual language does not test cloud controls. Covered entities should assess architecture, access management, incident detection, backup handling, subcontractors, and retention practices before transferring millions of patient records.
High-risk vendors need recurring technical review. Providers should ask how quickly the vendor can identify impacted individuals, whether customer data is segmented, how logs are protected, and whether incident exercises include coordinated patient notification.
The Aesto Health breach shows why concentration risk belongs in procurement decisions. A specialized vendor can improve migration reliability while simultaneously creating a repository whose compromise affects dozens of healthcare organizations and millions of people.
What remains unknown
The public notice does not reveal the initial-access technique, the attacker’s identity, or whether stolen information was sold or publicly released. It also does not provide a single detailed mapping of every affected provider and its patient count.
No evidence of misuse does not mean the data has been destroyed. Healthcare and identity information can remain valuable for years. Criminals may use it gradually, combine it with other breaches, or reserve it for targeted fraud.
Future updates should clarify how the AWS environment was accessed, what controls failed, whether all attacker persistence was removed, and how Aesto changed retention and tenant separation. Those facts matter for judging recurrence risk.
Where to track the canonical record
BreachHistory maintains the Aesto Health AWS breach record with the HHS count, incident timeline, data categories, and downstream-provider context.
Authoritative reporting and notices include BleepingComputer’s report on the 9.54 million census, HIPAA Journal’s healthcare-sector analysis, and Aesto Health’s official incident notice.
The bottom line
The Aesto Health data breach exposed the concentration risk created when a migration and archive provider stores information for many covered entities. Unauthorized access occurred from December 2 through December 18, 2025, forensics confirmed protected data involvement on May 26, 2026, and HHS reporting ultimately identified 9,540,683 affected people.
The possible fields include Social Security numbers, driver’s-license and government IDs, financial account data, insurance details, and medical information. Patients should use the offered 24-month Experian monitoring, freeze credit, review insurance claims and medical records, secure tax and email accounts, and verify every breach-related message through an official channel.