Graham County Hospital

Aesto, LLC, a healthcare data migration and archiving vendor, experienced a cyber incident affecting its AWS infrastructure. Unauthorized access occurred between December 2 and December 18, 2025, and was discovered on December 18, 2025. Protected health information (PHI) of individuals affiliated with Graham County Hospital, including minors, may have been accessed. Data types included names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and SSNs. Aesto engaged external cybersecurity professionals, secured the network, reset credentials, and deleted impacted Lambda functions. Graham County Hospital is offering cyber monitoring services to affected individuals.

Graham County Hospital reported a data breach to the Indiana Attorney General. The breach occurred on 2025-12-18 and was reported on 2026-09-14. 3 Indiana residents were affected. 6,659 individuals affected in total.

Graham County Hospital notified the NH Attorney General of a data security incident involving its third-party vendor, Aesto, LLC. Unauthorized access to patient data occurred between December 2 and December 18, 2025. GCH became aware of the incident on June 26, 2026. One New Hampshire resident was affected, with potential exposure of name, date of birth, and Social Security Number. GCH offered 12 months of credit monitoring.

Graham County Hospital notified patients that its vendor, Aesto, LLC, experienced a network security incident affecting AWS infrastructure. Unauthorized access to protected health information (PHI) occurred between Dec 2, 2025, and Dec 18, 2025. Aesto detected the issue on Dec 18, 2025, and confirmed the scope on May 26, 2026. Affected data includes names and PHI. Credit monitoring is offered.

Aesto, LLC, a healthcare data migration and archiving service provider, experienced a cyber incident affecting its AWS infrastructure between December 2 and December 18, 2025. The incident was discovered on December 18, 2025. Forensic analysis confirmed that an unauthorized actor accessed and potentially acquired protected health information (PHI), including names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, ITINs, and Social Security numbers, for individuals affiliated with Graham County Hospital and other covered entities. Aesto engaged external cybersecurity professionals, secured the network, reset credentials, and deleted impacted Lambda functions and unauthorized files. No evidence of data misuse was found. Aesto notified covered entities on June 26, 2026, and offered to notify HHS OCR on their behalf.

Graham County Hospital notified Massachusetts residents that a third-party vendor, Aesto, LLC, experienced a network security incident impacting its AWS infrastructure. Unauthorized access to protected health information (PHI) and basic identity data occurred between December 2 and December 18, 2025. Aesto discovered the incident on December 18, 2025, and confirmed the scope of affected data on May 26, 2026, following a forensic investigation. The hospital is offering complimentary credit monitoring and identity theft protection services to affected individuals.