Aesto Health Reports Data Breach Impacting Over 9.5 Million Patients
Aesto LLC, operating under the name Aesto Health, has revealed a significant data breach that impacts over 9.5 million individuals. The company, which provides software-as-a-service solutions for healthcare organizations, first announced the breach on June 24, 2026, through a notification on its website. The breach was traced back to an intrusion that occurred between December 2 and December 18, 2025, and was confirmed following a forensic investigation completed on May 26, 2026.
In its report to the U.S. Department of Health and Human Services, Aesto Health disclosed that the breach affected 9,540,683 individuals. The compromised data includes full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance details, individual taxpayer identification numbers, and Social Security numbers.
The incident has implications for 29 healthcare providers, including VillageMD and Everside Health. Aesto Health began informing those affected on August 21, 2026, providing details about the breach and offering a 24-month identity theft protection and credit monitoring service through Experian.
This breach follows a trend of similar incidents within the health technology sector, impacting various companies such as iRhythm and McKesson. As of now, no threat groups have claimed responsibility for the attack on Aesto Health. The incident highlights ongoing vulnerabilities in healthcare data security, particularly as attackers increasingly exploit valid credentials to gain access to sensitive information.
