Aesto Health cyber attack impacts more than 9.5 million people

Aesto Health, a healthcare data management company, has disclosed that more than 9.5 million people were affected by a cyber security breach after threat actors compromised its infrastructure and gained access to a portion of its Amazon Web Services (AWS) environment.

 

In a data security notice, Aesto Health revealed that it identified an unauthorised intrusion into its network on December 18, impacting a limited portion of its Amazon Web Services (AWS) environment. The company promptly launched an investigation with external cyber security experts to assess the scope of the incident.

 

It also took steps to secure the affected data center and notified relevant law enforcement authorities about the incident.

 

“After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorised actor” Aesto said in its data security incident notice.

 

The compromised data included names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers, other government identification numbers, and Social Security numbers. 

 

While initially Aesto did not reveal the number of affected individuals, in a recent filing with the U.S. Department of Health and Human Services, Aesto said as many as 9,540,683 people were impacted by the incident.

 

Although the healthcare data management company found no indication that the exposed information had been misused, it urged affected individuals to remain vigilant by regularly reviewing their credit reports, account and benefits statements, and to report any suspicious activity to law enforcement agencies, including local police and the state attorney general.

 

It has also offered complimentary credit monitoring services through Epiq to all affected individuals.

 

As of publication, no known hacker group had claimed responsibility for the cyberattack on Aesto. The company also did not disclose who was behind the attack, the amount of data compromised, or whether it had received a ransom demand.