Marana Health Center, Inc.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a network security incident impacting a portion of its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information, including names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and Social Security numbers, may have been accessed or acquired. Aesto engaged external cybersecurity professionals (GuidePoint) for investigation and remediation, which included closing security gaps, deleting impacted Lambda functions, and rotating AWS secrets. The incident is contained. Aesto is offering to notify HHS OCR on behalf of affected covered entities and providing notification packages for individual notices.

Marana Health Center notified the NH Attorney General of a data security incident involving its third-party vendor, Aesto, LLC. Unauthorized access to Aesto's AWS infrastructure occurred between December 2 and December 18, 2025. Marana Health Center became aware of the incident on June 26, 2026. The incident potentially affected 15 New Hampshire residents, exposing full name, date of birth, Social Security Number, and medical record number. Aesto confirmed the breach after forensic investigation. Marana Health Center offered 12 months of credit monitoring to affected individuals.

Marana Health Center, Inc. (AZ) reported to HHS on 2024-07-02 an Unauthorized Access/Disclosure affecting 542 individuals. A workforce member sent an email to patients containing PHI (including email addresses) of 542 individuals. Breached information was located in Email. The CE notified HHS, affected individuals, and the media, and provided complimentary credit monitoring and additional administrative, technical, and security safeguards.