Graham County Hospital
bd_f55f656ee8aa5141 · schema v1 · pii pii-v2
Full breach record for Graham County Hospital →Graham County Hospital notified Massachusetts residents that a third-party vendor, Aesto, LLC, experienced a network security incident impacting its AWS infrastructure. Unauthorized access to protected health information (PHI) and basic identity data occurred between December 2 and December 18, 2025. Aesto discovered the incident on December 18, 2025, and confirmed the scope of affected data on May 26, 2026, following a forensic investigation. The hospital is offering complimentary credit monitoring and identity theft protection services to affected individuals.
J jump to incidentP pin to compareR raw source
Incident timeline
Dec 2, 2025
Begins
Dec 18, 2025
Discovered
Sep 1, 2026
Filed
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- Massachusetts State AGbd_05527c3477a7fbe12026-09-01Verified
- Massachusetts State AGbd_552342ca92f193182026-09-01Candidate
- New Hampshire State AGbd_6f94ad8afcd0294b2026-09-11 · +10dVerified
- Indiana State AGbd_e67d6baea475da3d2026-09-14 · +13dVerified
Show 1 more filing ↓Show fewer ↑up to 30d gap
- Massachusetts State AGbd_e66b24c3665614af2026-10-01 · +30dVerified
Filing propagation · 6 filings · 3 states
View merged incident ↗Pattern: first filing Sep 1 (MA), last Oct 1 (MA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.