HackingHealthcareHealthcareSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDPHIMediumContained

Monroe County Health Center

bd_3945750ec5f3621d · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 7, 2026

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

62%

Full breach record for Monroe County Health Center →2 incidents on file

Monroe County Health Center notified Massachusetts residents of a data security incident at its third-party vendor, Aesto, LLC, which provides healthcare data migration and archiving services. An unauthorized actor accessed protected health information (PHI), including names, demographics, and Social Security numbers, between December 2 and December 18, 2025. Aesto confirmed the access on May 26, 2026, following a forensic investigation. The incident is contained. Monroe Health Center is offering 24 months of complimentary Experian identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 2, 2025

Begins

Aug 7, 2026

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_665745faf34541372026-08-06 · +1dVerified
New Hampshire State AGbd_4bc50661730b54d22026-09-02 · +26dVerified

Name: Monroe County Health Center
norm: monroe county health center

Name: Monroe County Health Center
norm: monroe county health center
Industry: Healthcarellm

Discovered: —
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Aesto, LLC

During the incident: Commenced a prompt and thorough investigation
Worked very closely with external cybersecurity professionals experienced in handling these types of incidents
Conducted extensive forensic investigation and manual document review
Offering a complimentary 24 month membership of Experian
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 6 · first

Massachusetts State AG+1d · this page

New Hampshire State AG+27d

Pattern: first filing Aug 6 (IN), last Sep 2 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1312-monroe-county-health-center/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2026
Raw hash: 80e23a75a20c8822d607c46b50806367cc49c05f904bc1bbe67f46ef04429f7f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMonroe County Health Center

Victim entityMonroe County Health Center

IncidentThird-Party / Supply Chain

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov