Aesto Health

Aesto, LLC, a third-party vendor for Ritchie County Primary Care Association d/b/a Integrated Health Centers of West Virginia, experienced a network security incident affecting its AWS infrastructure. Between December 2 and December 18, 2025, an unauthorized actor accessed protected health information (PHI) including names, SSNs, DOBs, and medical record numbers. Aesto became aware on December 18, 2025. Approximately 7 New Hampshire residents were affected. Credit monitoring is being offered.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a cyber incident affecting its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information (PHI) of individuals affiliated with Henry County Hospital and other covered entities may have been accessed or acquired. The data included names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and Social Security numbers. Aesto engaged external cybersecurity professionals, secured the network, reset credentials, and deleted impacted Lambda functions. No evidence of misuse was found. Aesto is offering credit monitoring and notification assistance to affected covered entities.

Allied Physicians Group notified patients that its vendor, Aesto, LLC, experienced a network security incident. An unauthorized actor copied protected health information (PHI) and full names from Aesto's AWS infrastructure between December 2 and December 18, 2025. Aesto detected the incident on December 18, 2025, and confirmed the data exfiltration on May 26, 2026. The incident is contained. Allied Physicians Group is offering credit monitoring services to affected individuals.

Aesto, LLC, a healthcare data archiving provider, disclosed a cyber incident affecting Mountrail County Medical Center. Unauthorized access occurred between Dec 2-18, 2025, impacting a limited portion of AWS infrastructure. Protected health information (names, DOB, SSN, driver's license, financial accounts) of some individuals was accessed. Aesto engaged GuidePoint Security for forensic investigation, contained the breach by Dec 18, 2025, and notified affected entities on June 26, 2026.

Ritchie County Primary Care Association d/b/a Integrated Health Centers of West Virginia notified Massachusetts residents of a data security incident at its third-party vendor, Aesto, LLC, which provides healthcare data migration and archiving services. The incident involved protected health information (PHI). The notice, dated October 22, 2026, states that Aesto has no evidence of misuse for identity theft or financial fraud but offered 24 months of credit monitoring. Specific details of the breach nature, dates of occurrence, or discovery are withheld due to Massachusetts law requirements.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a cyber incident affecting its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information, including names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and Social Security numbers, may have been accessed or acquired. Aesto notified covered entities, including Settlement Health and Medical, on June 26, 2026. The incident has been contained, and Aesto has implemented remediation measures including closing security gaps, deleting impacted Lambda functions, and rotating AWS secrets.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a network security incident impacting a portion of its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information, including names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and Social Security numbers, may have been accessed or acquired. Aesto engaged external cybersecurity professionals (GuidePoint) for investigation and remediation, which included closing security gaps, deleting impacted Lambda functions, and rotating AWS secrets. The incident is contained. Aesto is offering to notify HHS OCR on behalf of affected covered entities and providing notification packages for individual notices.

Aesto, LLC, a healthcare data migration and archiving vendor, experienced a cyber incident affecting its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information (PHI) of individuals affiliated with Graham County Hospital, including minors, may have been accessed. Data types included names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and SSNs. Aesto engaged external cybersecurity professionals, secured the network, reset credentials, and deleted impacted Lambda functions. Graham County Hospital is offering cyber monitoring services to affected individuals.

Aesto, LLC, a provider of healthcare data migration and archiving services, experienced a network security incident impacting its Amazon Web Services infrastructure. Unauthorized access to patient information, including names and Social Security numbers, occurred between December 2 and December 18, 2025. The incident was discovered on December 18, 2025. Approximately 25 New Hampshire residents were affected. Aesto engaged external cybersecurity professionals for a forensic investigation and notified the third-party customer, Consensus Medical Group, and the U.S. Department of Health and Human Services. Affected individuals are offered 12 months of complimentary credit monitoring.

Aesto, LLC reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-09-25. The reporting organization type is Other Commercial. 27 Vermont residents were affected. Categories of data breached: Social Security Numbers, Health Records.

Graham County Hospital notified patients that its vendor, Aesto, LLC, experienced a network security incident affecting AWS infrastructure. Unauthorized access to protected health information (PHI) occurred between Dec 2, 2025, and Dec 18, 2025. Aesto detected the issue on Dec 18, 2025, and confirmed the scope on May 26, 2026. Affected data includes names and PHI. Credit monitoring is offered.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a network security incident impacting its AWS infrastructure. Unauthorized access to protected health information (PHI) and identity data occurred between December 2 and December 18, 2025. The incident was discovered on December 18, 2025. Aesto engaged external cybersecurity professionals for forensic investigation. Affected individuals include residents of Massachusetts and Rhode Island. Complimentary credit monitoring and identity theft protection services were offered for 12 months.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a network security incident impacting its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information, including names, dates of birth, SSNs, and medical records for patients of Orthopaedics & Sports Medicine Owensboro, may have been accessed or acquired. Aesto engaged external cybersecurity professionals and notified the affected healthcare provider. Identity theft protection services are being offered to affected individuals.

Graham County Hospital notified Massachusetts residents that a third-party vendor, Aesto, LLC, experienced a network security incident impacting its AWS infrastructure. Unauthorized access to protected health information (PHI) and basic identity data occurred between December 2 and December 18, 2025. Aesto discovered the incident on December 18, 2025, and confirmed the scope of affected data on May 26, 2026, following a forensic investigation. The hospital is offering complimentary credit monitoring and identity theft protection services to affected individuals.

Aesto LLC, a healthcare data migration and archiving services provider, experienced a network security incident impacting its Amazon Web Services infrastructure. An unauthorized actor accessed and/or acquired personal information pertaining to care for some individuals between December 2 and December 18, 2025. Aesto discovered the incident on December 18, 2025. The affected data includes full names and other variable personal health information. Aesto notified its healthcare provider client, Allied Health MSO Holdco, LLC, on June 26, 2026. Aesto is offering complimentary credit monitoring and identity theft protection services to affected individuals.

Aesto, LLC reported a data breach to the Oregon Attorney General. The breach was reported on 2026-08-05. The breach occurred during 12/2/2025 - 12/18/2025. The breach was discovered on 12/18/2025. 1 individuals were affected. Notice was sent on 6/26/20267/31/2026.

Aesto, LLC reported unauthorized access to its AWS infrastructure between Dec 2 and Dec 18, 2025. The incident impacted sensitive information pertaining to HIPAA Covered Entity Clients. Aesto notified affected entities on June 26, 2026. 37,253 Washington residents were affected. No evidence of misuse was found.

AESTO, LLC filed a data-breach notice with the Illinois Attorney General in August 2026 (case 26-08-1371). The register records the breach as discovered on May 26, 2026. Personal information types reported: drivers license, financial account number, medical information, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

AESTO, LLC filed a data-breach notice with the Illinois Attorney General in August 2026 (case 26-08-1382). The register records the breach as discovered on June 26, 2026. Personal information types reported: ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Aesto, LLC, a healthcare data migration and archiving service provider for Allied Health MSO Holdco, LLC, experienced a data security incident affecting personal information of Massachusetts residents. The incident involved a third-party vendor. Affected data types likely include PHI and PII (SSN, DOB, address). Aesto is offering 24 months of credit monitoring and identity theft protection. No specific dates for discovery or occurrence are provided in the notice letter.

Aesto, LLC reported to HHS on 2026-07-31 a Hacking/IT Incident affecting 9540683 individuals. Breached information located on Network Server.

Aesto Health reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-07-31. The reporting organization type is Health Care. 91 Vermont residents were affected. Categories of data breached: Social Security Numbers, Health Records.

Aesto, LLC d/b/a Aesto Health (AL) reported to HHS on 2022-05-20 a Hacking/IT Incident (ransomware attack) affecting 17,400 individuals. Breached PHI was located on a Network Server and included names, dates of birth, and clinical information. The CE notified HHS, affected individuals, and the media, provided substitute notice, and implemented additional administrative, technical, and security safeguards in response.