HackingHealthcareTechnologyHealthcareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPHICriticalContained

Aesto Health

bd_7afae1cfba7459a5 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Dec 18, 2025

Filed

Jul 31, 2026

To disclose

32 weeks

Affected · nationwide

107,34913 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Aesto Health →6 incidents on file

Aesto, LLC, a third-party healthcare data migration vendor, experienced a network security incident on its AWS infrastructure between Dec 2-18, 2025. Unauthorized actors accessed patient records (names, SSNs, PHI) for 107,349 individuals, including 13 NH residents. Village Practice Management Company (VPM) notified the NH AG on July 31, 2026, after receiving confirmation from Aesto. Patients received notification letters and complimentary credit/identity monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 32 weeks / 225 days

Dec 2, 2025

Begins

Dec 18, 2025

Discovered

Jul 31, 2026

Filed

vs. sector median

+21 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_3a91ce22cef72ff32026-07-31Candidate
New Hampshire State AGbd_67f13a4222e410302026-07-31Verified
Vermont State AGbd_ed89224a3d3fa39d2026-07-31Verified
Massachusetts State AGbd_efc058e9ea799e382026-07-31Candidate

Show 1 more filing ↓up to 5d gap

Oregon State AGbd_ffdc3411341bf72d2026-08-05 · +5dVerified

Name: Village Practice Management Company, LLC
norm: village practice management

Name: Aesto Health
norm: aesto health
Domain: aestohealth.com
Industry: HealthcarellmTechnologyllm

Discovered: Dec 18, 2025
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2026
Affected individuals: 107,349state + nationwide
Data types: Identity (basic)Government IDPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Launched an investigation with the assistance of external cybersecurity professionals
Conducted a forensic investigation and manual document review
Mailed notification letters to affected patients
Offered complimentary credit and identity monitoring services through Epiq
Changes made: Continually evaluating and modifying its practices to enhance the security and privacy of protected information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

California State AGJul 31 · first

New Hampshire State AGJul 31 · first

Vermont State AGJul 31 · first

Massachusetts State AGJul 31 · first

New Hampshire State AGJul 31 · first · this page

Oregon State AG+5d

Pattern: first filing Jul 31 (CA), last Aug 5 (OR) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/village-practice-management-20260731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2026
Raw hash: bfd40efb5cb33aca4f279acdb0c2af7a3215bbeb2c2e1442424fc517ca1c7f14

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityVillage Practice Management Company, LLC

Victim entityAesto Health

Incidentdiscovered Dec 18, 2025

Stated responseLaunched an investigation with the assistance of external cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov