HackingHealthcareTechnologyHealthcareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHealth (basic)Financial accountCriticalContained

Orthopedics & Sports Medicine Owensboro, P.S.C.

bd_fa84e6244cba3f62 · schema v1 · pii pii-v2

Severity

Critical

Discovered

Jun 26, 2026

Filed

Sep 23, 2026

To disclose

13 weeks

Affected · nationwide

100,0003 in this filing

Confidence

69%

Full breach record for Orthopedics & Sports Medicine Owensboro, P.S.C. →2 incidents on file

Aesto, LLC, a healthcare data migration provider, experienced a network security incident affecting its AWS infrastructure between Dec 2-18, 2025. Discovered May 26, 2026, the breach exposed PHI, SSNs, and financial data of ~9.5M individuals. AC4O, a Kentucky provider, notified ~100k affiliates, including 3 NH residents, on Aug 25, 2026. Aesto offered credit monitoring and ID theft recovery.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 206 days

discovery → filing · 13 weeks / 89 days

Dec 2, 2025

Begins

Jun 26, 2026

Discovered

Sep 23, 2026

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed100,000 affectedView incident

Name: Orthopedics & Sports Medicine Owensboro, P.S.C.
norm: orthopedics sports medicine owensboro psc

Name: Orthopedics & Sports Medicine Owensboro, P.S.C.
norm: orthopedics sports medicine owensboro psc
Industry: HealthcarellmTechnologyllm

Discovered: Jun 26, 2026
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 206 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 25, 2026
Affected individuals: 100,000state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via Aesto, LLCbusiness associate
Initial access: exploit_public_facing

During the incident: Engaged external cybersecurity professionals
Conducted extensive forensic investigation and manual document review
Notified AC4O of the incident
Sent written notice to affected individuals
Sent substitute notice pursuant to HIPAA
Offered 12 months of credit and CyberScan monitoring
Offered $1,000,000 insurance reimbursement policy
Offered fully managed ID theft recovery services through IDX
Changes made: Evaluated and modified practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/orthopaedics-sports-medicine-owensboro-advanced-center-orthopedics-sports-medicine-20260923.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2026
Raw hash: 1acf71281ebb5ecc5daadd84e964047bfa0b311e5de9b3bdf28c543552ad8618

Reporting entityOrthopedics & Sports Medicine Owensboro, P.S.C.

Victim entityOrthopedics & Sports Medicine Owensboro, P.S.C.

Incidentdiscovered Jun 26, 2026

Stated responseEngaged external cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov