UnknownLow

Aesto Health

bd_ffdc3411341bf72d · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 18, 2025

Filed

Aug 5, 2026

To disclose

33 weeks

Affected

Linked

12 filings

Confidence

95%

Full breach record for Aesto Health →2 incidents on file

Aesto, LLC reported a data breach to the Oregon Attorney General. The breach was reported on 2026-08-05. The breach occurred during 12/2/2025 - 12/18/2025. The breach was discovered on 12/18/2025. 1 individuals were affected. Notice was sent on 6/26/20267/31/2026.

J jump to incidentP pin to compareR raw source

Oregon clock✗ OR AG >45d33 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 16 days

discovery → filing · 33 weeks / 230 days

Dec 2, 2025

Begins

Dec 18, 2025

Discovered

Aug 5, 2026

Filed

This filing is one of 12 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Washington State AGbd_6ba6b179ea4373bf2026-08-04 · +1dVerified
Illinois State AGbd_49a6928816a82c852026-08-01 · +4dVerified
Illinois State AGbd_a10ec3898d9326e02026-08-01 · +4dVerified
HHS OCRbd_6054557cd914ee672026-07-31 · +5dCandidate

Show 6 more filings ↓up to 57d gap

California State AGbd_65f70444b3fbe6f72026-08-24 · +19dVerified
Massachusetts State AGbd_a7593a37841d8ff02026-09-01 · +27dVerified
Massachusetts State AGbd_b1d347b681553e3a2026-09-01 · +27dVerified
New Hampshire State AGbd_7148309868a16c342026-09-25 · +51dVerified
Vermont State AGbd_8145059268bb2d362026-09-25 · +51dVerified
California State AGbd_b3f56c134cd959942026-10-01 · +57dVerified

Showing first 10 of 11 linked disclosures.

Name: Aesto Health
norm: aesto health
Domain: aestohealth.com

Name: Aesto Health
norm: aesto health
Domain: aestohealth.com

Discovered: Dec 18, 2025
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1nationwide
Data types: —
Attack vector: Unknown

Time to disclose: 33 weeks(230 days from discovery to filing)
Compliance flags: OR AG >45d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

HHS OCRJul 31 · first

Illinois State AG+1d

Washington State AG+4d

Oregon State AG+5d · this page

California State AG+24d

Massachusetts State AG+32d

New Hampshire State AG+56d

Vermont State AG+56d

California State AG+62d

Pattern: first filing Jul 31 (AL), last Oct 1 (CA) — a 62-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://justice.oregon.gov/consumer/DataBreach/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 5, 2026
Raw hash: df1a2b9f8345b7c496adef75125c4769b9d10584214f06b48d134f9bb94d234c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAesto Health

Victim entityAesto Health

Incidentdiscovered Dec 18, 2025

ComplianceOR AG >45d

Extraction provenanceno artifact recorded

Source provenancejustice.oregon.gov