Aesto Health, a U.S.-based healthcare data migration and archiving provider, has disclosed a major cybersecurity incident involving a portion of its Amazon Web Services (AWS) infrastructure.
The incident is now reported to have affected 9,540,683 individuals, making it one of the largest healthcare-related data breaches reported in 2026.
What Happened?
Aesto detected unauthorized activity affecting a limited portion of its AWS environment on December 18, 2025.
According to Aesto’s investigation, the unauthorized activity occurred between approximately December 2 and December 18, 2025.
Aesto contained the incident and engaged external cybersecurity specialists to conduct a forensic investigation and review potentially affected files.
On May 26, 2026, following its investigation and manual document review, Aesto confirmed that certain protected health information (PHI) stored within its environment may have been accessed and/or acquired by an unauthorized actor.
Aesto publicly disclosed the incident on June 24, 2026, and began notifying affected healthcare clients from June 26, 2026.
What Information Was Involved?
The information varied between individuals but potentially included:
- Full names
- Dates of birth
- Medical information
- Health insurance information
- Driver’s-license numbers
- Government identification numbers
- Financial account numbers
- Individual Taxpayer Identification Numbers (ITINs)
- Social Security numbers
Aesto specifically stated that Social Security numbers were potentially involved for a limited number of individuals.
The Scale of the Breach
The scale became clearer when the incident was reported to the U.S. Department of Health and Human Services (HHS).
The HHS breach reporting data lists 9,540,683 affected individuals.
Reporting also indicates that the incident involved patient information associated with at least two dozen healthcare provider clients across multiple U.S. states.
This is significant because Aesto operates as a healthcare technology and data-services provider rather than as a single hospital or medical practice. Its systems can therefore contain information originating from multiple healthcare organizations.
A Third-Party Healthcare Data Incident
Aesto provides healthcare data migration and archiving services for covered entities.
That means the incident occurred within a technology provider’s environment where healthcare organizations had entrusted patient information for migration, exchange, or archival purposes.
Several healthcare organizations have subsequently issued their own breach notifications identifying Aesto as the affected service provider. For example, public notices describe patient information stored within Aesto’s environment as potentially accessed or copied during the December incident.
Timeline
December 2, 2025
The reported period of unauthorized activity begins.
December 18, 2025
Aesto detects unauthorized activity affecting a limited portion of its AWS infrastructure and begins containment and investigation.
May 26, 2026
Aesto’s forensic investigation and manual document review confirms that certain information may have been accessed or acquired.
June 24, 2026
Aesto publicly posts its data-security incident notice.
June 26, 2026
Notification to affected healthcare clients begins.
August–September 2026
Additional healthcare organizations continue issuing individual breach notifications, while the reported number of affected individuals reaches 9,540,683 in HHS reporting.
What Aesto Says About Misuse
Aesto has stated that it has no evidence of identity theft or financial fraud related to the incident.
That statement is important because the exposure of sensitive healthcare and identity information does not, by itself, establish that the information has subsequently been misused.
The confirmed facts are therefore narrower:
Unauthorized activity occurred → information was potentially accessed/acquired → affected data was identified → healthcare clients were notified.
There is currently no confirmed evidence from Aesto of resulting identity theft or financial fraud.
What Remains Unknown
Several technical details have not been publicly established by Aesto.
The company has not publicly disclosed:
- The identity of the threat actor
- The initial access technique
- The specific AWS service or resource exploited
- Whether credentials, an application vulnerability, or another access mechanism was involved
- Whether ransomware was deployed
- Whether the attacker maintained persistence
- The exact volume of data exfiltrated
- Whether all 9.54 million individuals had the same categories of information exposed
These distinctions matter. The existence of a large affected population should not be interpreted as evidence of a particular attack technique unless that technique is publicly confirmed.
The Bigger Picture
The Aesto incident demonstrates the potential scale of a breach involving a healthcare technology provider.
The affected information was distributed across data belonging to multiple healthcare organizations, while the reported compromise occurred within a portion of a shared technology environment.
The most important fact is therefore not simply the 9.5 million figure.
It is that a single incident at a healthcare data-services provider can potentially propagate across multiple healthcare organizations and patient populations.
For now, the publicly confirmed story is straightforward: Aesto’s AWS environment experienced unauthorized activity in December 2025, an investigation later identified potentially accessed healthcare and personal information, and HHS reporting now lists more than 9.5 million affected individuals.
The technical details behind the initial compromise remain largely undisclosed.
