HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PIIPHIIdentity (basic)Government IDFinancial accountMediumContained

AESTO, LLC

bd_64f64f39cb8a849a · schema v1 · pii pii-v2

Severity

Medium

Discovered

May 26, 2026

Filed

Aug 28, 2026

To disclose

13 weeks

Affected

10state residents only

Linked

9 filings

Confidence

70%

Full breach record for AESTO, LLC →

Diana Health, Inc. notified the New Hampshire Attorney General of a data security incident involving its vendor, Aesto LLC d/b/a Aesto Health. Between December 2 and December 18, 2025, an unauthorized actor accessed and copied data from Aesto's AWS infrastructure. The incident impacted approximately 10 New Hampshire residents, exposing names, Social Security numbers, and other personal identifiers. Diana Health began mailing notices on August 28, 2026, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 175 days

discovery → filing · 13 weeks / 94 days

Dec 2, 2025

Begins

May 26, 2026

Discovered

Aug 28, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_4fe674ca1413cfc02026-08-27 · +1dVerified
Massachusetts State AGbd_d39e08ca3ce7e1182026-09-01 · +4dVerified
California State AGbd_65f70444b3fbe6f72026-08-24 · +4dVerified
New Hampshire State AGbd_b5839d18101d09ca2026-08-21 · +7dVerified

Show 4 more filings ↓up to 28d gap

New Hampshire State AGbd_eac49aabb3a023ff2026-08-21 · +7dVerified
Illinois State AGbd_49a6928816a82c852026-08-01 · +27dCandidate
Illinois State AGbd_a10ec3898d9326e02026-08-01 · +27dVerified
HHS OCRbd_6054557cd914ee672026-07-31 · +28dCandidate

Name: Diana Health, Inc.
norm: diana health

Name: AESTO, LLC
norm: aesto
Also named: Aesto LLCdba oflegal entity
Aesto Healthdba oftrade name
Industry: Healthcarellm

Discovered: May 26, 2026
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 175 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2026
Affected individuals: 10state-resident count only
Data types: PIIPHIIdentity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed Notice of Data Event with New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists
Conducted extensive forensic investigation and manual document review
Notified Diana Health
Began mailing notice letters to affected New Hampshire residents
Posted notice of the event on its website
Provided notice to major statewide media in New Hampshire
Changes made: Provided complimentary credit monitoring to impacted individuals
Established a dedicated call center to answer questions about the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 5 states

View merged incident ↗

HHS OCRJul 31 · first

Illinois State AG+1d

New Hampshire State AG+21d

California State AG+24d

New Hampshire State AG+27d

New Hampshire State AG+28d · this page

Massachusetts State AG+32d

Pattern: first filing Jul 31 (AL), last Sep 1 (MA) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/diana-health-20260828.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2026
Raw hash: 70c95da94584f643ca650dba459fdf44f139ca78910e4dcde067b9aeb7eabc6f

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityDiana Health, Inc.

Victim entityAESTO, LLC

Incidentdiscovered May 26, 2026

Stated responseEngaged third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov