Aesto Health data breach exposes 9.5 million patient records

September 1, 2026 at 02:09 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Aesto Health disclosed that hackers stole personal and health information of more than 9.5 million people from its AWS infrastructure. The Birmingham, Alabama-based healthcare technology company detected the breach on December 18, 2025, and determined on May 26, 2026, that data was exfiltrated between December 2 and 18. The U.S. Department of Health and Human Services added the incident to its data breach portal on Monday.

Key Facts

Aesto Health notified the U.S. Department of Health and Human Services that 9,540,683 individuals were impacted by the data breach.
The breach was discovered on December 18, 2025, and involved portions of Aesto Health's Amazon Web Services infrastructure.
The company's investigation determined on May 26, 2026, that hackers exfiltrated personally identifiable information and protected health information between December 2 and 18.
Compromised data includes names, Social Security numbers, driver's license numbers, dates of birth, financial account numbers, medical information, and health insurance information.
At least two dozen Aesto Health healthcare provider clients across several states were affected by the incident.

Breach Discovery and Investigation

Aesto Health detected unauthorized activity on December 18, 2025, and immediately contained the incident. The company engaged leading cybersecurity experts to identify what personal information was involved. On May 26, 2026, the investigation concluded that hackers exfiltrated personally identifiable information and protected health information between December 2 and 18.

Data Types and Notification

The compromised information includes names, Social Security numbers, driver's license numbers, other ID numbers, dates of birth, financial account numbers, medical information, health insurance information, and taxpayer identification numbers. Aesto Health notified the U.S. Department of Health and Human Services that 9,540,683 individuals were impacted. HHS added the company to its data breach portal on Monday.

Affected Healthcare Providers

At least two dozen Aesto Health healthcare provider clients across several states have been affected by the incident. Some of these clients have chosen to notify the potentially affected people themselves.