Aesto Health Data Breach Exposes Personal Information of 9.5 Million Individuals
Aesto Health, a healthcare technology company based in Birmingham, Alabama, has disclosed a significant data breach that has exposed the personal and health information of over 9.5 million individuals. The company reported the incident was discovered on December 18, 2025, when attackers gained access to part of its Amazon Web Services infrastructure.
The breach occurred between December 2 and December 18, 2025, during which certain protected health information belonging to patients of various clients may have been accessed or acquired by an unauthorized actor. Aesto Health provides services that include secure data migration and electronic health record exchanges, which makes the security of its infrastructure critical.
In a notice regarding the data security incident, Aesto Health stated that after a thorough forensic investigation, it confirmed the breach on May 26, 2026. The exposed data may include names, birth dates, medical and insurance information, driver’s license and government ID numbers, financial account details, taxpayer IDs, and, for a limited number of individuals, Social Security numbers.
Despite the severity of the breach, Aesto Health reported finding no evidence of identity theft or financial fraud linked to the incident. The company began notifying affected healthcare clients on June 26, 2026, ensuring that those whose data may have been compromised were informed.
In response to the breach, Aesto Health has implemented measures to enhance its security protocols and has established a dedicated helpline for inquiries related to the incident. Additionally, the company has notified the U.S. Department of Health and Human Services, indicating that the breach impacted approximately 9,540,683 individuals.
