Aesto Health says data breach affects over 9.5 million patients

Aesto LLC, operating as Aesto Health, experienced a data breach involving unauthorized access to sensitive patient data stored on its network. The intrusion occurred in December 2025 and was confirmed in May 2026 after forensic analysis. The breach compromised protected health information of approximately 9.54 million individuals, including personally identifiable information and medical details. The breach affected data stored on a portion of Aesto's Amazon Web Services infrastructure. The company notified affected individuals in August 2026 and provided credit monitoring services. This breach is part of a broader pattern of cyber incidents targeting healthtech software providers. No public claims of responsibility by threat actors have been made.

The breach exposed sensitive personal and health information of over 9.5 million patients, including identifiers such as Social Security numbers, medical records, financial account numbers, and government-issued IDs. This exposure increases the risk of identity theft, financial fraud, and privacy violations for affected individuals. The incident also indirectly impacts 29 healthcare providers relying on Aesto's services. The breach undermines trust in the affected healthcare organizations and may result in regulatory scrutiny and potential legal consequences under data protection laws such as HIPAA.

Aesto Health has informed affected individuals and offered 24 months of identity theft protection and credit monitoring through Experian. Organizations using Aesto's services should review their own security postures and monitor for suspicious activity related to the compromised data. Since the breach involved a portion of Aesto's AWS infrastructure, remediation and patching are managed internally by Aesto. No public information indicates additional mitigation steps or patches are required by customers. Stakeholders should follow official communications from Aesto Health for updates.