Catalyst Health Group reveals data breach linked to service provider Aesto Health

Catalyst Health Group has revealed that a security incident at its service provider, Aesto Health has exposed the sensitive data of its patients.

 

Headquartered in Plano, Texas, Catalyst Health Group is a physician-led primary care organization operating 21 clinics with over 100 providers and 500 staff. Aesto Health, a third-party technology vendor, provided data migration and archiving services for Catalyst Physician Group.

 

In a data security notice submitted to the office of California Attorney General, Catalyst Physician Group said that its vendor Aesto Health identified an unauthorised intrusion into a limited portion of its AWS cloud environment on December 18. Aesto engaged external cyber security specialists to investigate the scope of the incident.

 

It also took steps to secure the affected data center and notified relevant law enforcement authorities about the incident.

 

“After an extensive forensic investigation and manual document review, on May 26, 2026, Aesto confirmed that between on or about December 2, 2025, and December 18, 2025, a limited amount of your protected health information pertaining to Catalyst Physician Group, which was stored within Aesto’s network, may have been accessed and/or acquired by an unauthorised actor,” Catalyst Physician Group said.

 

While Catalyst Physician Group did not specify the exact records exposed, Aesto reported that the compromised data included names, dates of birth, medical histories, driver’s licenses, financial account numbers, health insurance details, ITINs, government IDs, and Social Security numbers.

 

In a filing with the U.S. Department of Health and Human Services, Aesto puts total affected individuals at up to 9,540,683. However, Catalyst Physician Group has not yet specified how many of its own patients are among them.

 

Although Aesto found no evidence of misuse, it urged affected individuals to monitor credit reports, account statements, and benefit records closely, reporting any suspicious activity to local police or the state attorney general.

 

It has also offered complimentary credit monitoring services through Epiq to all affected individuals.

 

As of publication, no known hacker group had claimed responsibility for the cyberattack on Aesto. The company also did not disclose who was behind the attack, the amount of data compromised, or whether it had received a ransom demand.