Catalyst Physician Group
bd_e02beb75c1898505 · schema v1 · pii pii-v2
Full breach record for Catalyst Physician Group →Catalyst Physician Group notified the NH Attorney General of a data breach involving its third-party vendor, Aesto, LLC. An unauthorized actor accessed patient data stored on Aesto's AWS infrastructure between December 2 and December 18, 2025. Catalyst became aware of the incident on June 26, 2026, when Aesto notified them. The breach affected 13 New Hampshire residents, exposing names, addresses, Social Security numbers, medical record numbers, and dates of birth. Notification letters were mailed on September 11, 2026, offering credit monitoring and identity theft protection.
J jump to incidentP pin to compareR raw source
Incident timeline
Dec 2, 2025
Begins
Jun 26, 2026
Discovered
Sep 16, 2026
Filed
vs. sector median
+3 wks slower
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- Texas State AGbd_b9a49e9684fcffbf2026-09-15 · +1dVerified
- California State AGbd_8925f3925d1e52822026-09-11 · +5dCandidate
- Massachusetts State AGbd_f402870fea4371242026-09-01 · +15dCandidate
Filing propagation · 4 filings · 4 states
View merged incident ↗Pattern: first filing Sep 1 (MA), last Sep 16 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.