HackingHealthcareTechnologyHealthcareData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Financial accountHealth (basic)MediumContained

Diana Health, Inc.

bd_64f64f39cb8a849a · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jun 26, 2026

Filed

Aug 28, 2026

To disclose

9 weeks

Affected

10state residents only

Linked

3 filings

Confidence

69%

Full breach record for Diana Health, Inc. →

Aesto LLC d/b/a Aesto Health, a healthcare data migration vendor, experienced a network security incident impacting its AWS infrastructure. An unauthorized actor accessed and copied data between December 2 and December 18, 2025. The incident was discovered on December 18, 2025. Diana Health, Inc., a client of Aesto, notified approximately 10 New Hampshire residents whose names and Social Security numbers were potentially accessed. Aesto engaged forensic specialists and contained the incident. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 206 days

discovery → filing · 9 weeks / 63 days

Dec 2, 2025

Begins

Jun 26, 2026

Discovered

Aug 28, 2026

Filed

vs. sector median

on median

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_5d4b9fe7a3bdf3ef2026-08-28Verified
Massachusetts State AGbd_7cde2d19e328e52a2026-08-01 · +27dCandidate

Name: Diana Health, Inc.
norm: diana health

Name: Diana Health, Inc.
norm: diana health
Industry: HealthcarellmTechnologyllm

Discovered: Jun 26, 2026
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 206 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2026
Affected individuals: 10state-resident count only
Data types: PHIGovernment IDIdentity (basic)Financial accountHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via Aesto LLC d/b/a Aesto Health

During the incident: Commenced an investigation into the full nature and scope of the incident
Worked closely with third-party forensic specialists
Contained the incident
Notified Covered Entity clients whose patient information was included
Posted notice of this event on its website
Provided notice to major statewide media
Began mailing notice letters to affected New Hampshire residents
Established a dedicated call center to answer questions
Changes made: Continually evaluates and modifies practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 1 · first

Vermont State AG+27d

New Hampshire State AG+27d · this page

Pattern: first filing Aug 1 (MA), last Aug 28 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/diana-health-20260828.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2026
Raw hash: 70c95da94584f643ca650dba459fdf44f139ca78910e4dcde067b9aeb7eabc6f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDiana Health, Inc.

Victim entityDiana Health, Inc.

Incidentdiscovered Jun 26, 2026

Stated responseCommenced an investigation into the full nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov