HackingHealthcareHealthcareSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)Government IDPHIMediumContained

Kaniksu Community Health

bd_8b1fcdd22fe5d2de · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jun 26, 2026

Filed

Sep 1, 2026

To disclose

—

Affected

14state residents only

Linked

3 filings

Confidence

68%

Full breach record for Kaniksu Community Health →2 incidents on file

Kaniksu Community Health notified patients of a data incident involving its third-party healthcare data management provider, Aesto, LLC. Unauthorized access to Aesto's platform occurred on December 18, 2025, but Kaniksu was not informed until June 26, 2026. The incident potentially affected patient data, including protected health information and personal identifiers. Kaniksu engaged a cybersecurity firm to investigate and is offering identity monitoring services through Kroll. The incident is contained, and no misuse of data has been detected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 190 days

Dec 18, 2025

Begins

Jun 26, 2026

Discovered

Sep 1, 2026

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_9ca06938a39c16172026-09-01Candidate
Vermont State AGbd_c0324af55cfdb1a62026-09-05 · +4dVerified

Name: Kaniksu Community Health
norm: kaniksu community health

Name: Kaniksu Community Health
norm: kaniksu community health
Industry: Healthcarellm

Discovered: Jun 26, 2026
Breach occurred: Dec 18, 2025
Undetected for: 190 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14state-resident count only
Data types: Health (basic)Identity (basic)Government IDPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Aesto, LLC
Initial access: supply_chain

During the incident: Launched an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Secured the services of Kroll to provide identity monitoring at no cost
Changes made: Evaluating opportunities to further secure our systems
Ensuring that our service providers do the same to prevent a similar event from occurring again in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGSep 1 · first

Massachusetts State AGSep 1 · first · this page

Vermont State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1494-kaniksu-community-health/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 0b218d1773ccf28756d124a8ab4e3eb437adb9a969f2e80768311493848c368e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKaniksu Community Health

Victim entityKaniksu Community Health

Incidentdiscovered Jun 26, 2026

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov