Aesto Health breach exposes health and identity data of 9.5 million people

Aesto Health, a healthcare technology company that handles data migration, records exchange, and archiving for medical providers, disclosed that a breach of its Amazon Web Services infrastructure exposed the personal and health information of more than 9.5 million people. Attackers accessed the environment in December 2025, and the company later confirmed they took names, Social Security and driver's license numbers, dates of birth, financial account numbers, and detailed medical and insurance information. Because Aesto is a vendor serving many providers, the single breach cascades to roughly two dozen healthcare clients. It is the second-largest confirmed US healthcare breach reported this year, and the data enables identity theft and targeted fraud.

Check

If you are a provider using Aesto Health or a patient of one, watch for breach notifications, monitor medical, insurance, and financial statements, and treat health-themed phishing referencing real details with suspicion.

Affected

More than 9.5 million patients across about two dozen providers served by Aesto Health; exposed names, Social Security numbers, financial accounts, and medical records support identity theft, insurance fraud, and targeted phishing.

Fix

Affected people should monitor accounts and consider credit protection; organizations should secure cloud infrastructure, minimize retained data, encrypt records, and vet the security of data-handling vendors whose breach would cascade.