9.5 Million Impacted by Aesto Health Data Breach

In a data breach disclosed by Aesto Health, hackers accessed and exfiltrated sensitive personal and health information from the company's Amazon Web Services infrastructure. The breach affected approximately 9.54 million individuals and included a wide range of personally identifiable information (PII) and protected health information (PHI). The incident was detected on December 18, 2025, with unauthorized activity traced back to December 2. Aesto Health promptly contained the breach and initiated a thorough investigation with external cybersecurity experts. The company has reported the breach to the US Department of Health and Human Services, which has publicly listed the incident. Multiple healthcare provider clients of Aesto Health were also impacted, some of whom have independently notified affected individuals.

The breach exposed sensitive PII and PHI of over 9.5 million individuals, including critical identifiers such as Social Security numbers, driver’s license numbers, financial account numbers, and medical and insurance information. This exposure poses significant risks of identity theft, financial fraud, and privacy violations for the affected individuals. Healthcare providers relying on Aesto Health's services may face reputational damage and regulatory scrutiny. The incident also highlights risks associated with cloud infrastructure security in healthcare environments.

Aesto Health has contained the breach and engaged cybersecurity experts to investigate and remediate the incident. The company has notified the US Department of Health and Human Services and affected clients. No specific patch or fix applies as this is a breach incident involving cloud infrastructure compromise. Organizations using Aesto Health services should follow official notifications and guidance from Aesto Health and regulatory bodies. Affected individuals should be advised to monitor their financial and personal accounts for suspicious activity.