What Changed
Aesto LLC, operating as Aesto Health, has told the U.S. Department of Health and Human Services that a data breach affects 9,540,683 people. Aesto provides software that helps healthcare organizations migrate, archive and access patient data when they replace electronic health record systems or acquire medical practices.
The company first disclosed the attack on June 24, saying “a limited portion” of its Amazon Web Services infrastructure had been compromised. A forensic investigation confirmed on May 26 that protected health information stored on its network may have been accessed or taken between about December 2 and December 18, 2025.
What Was Exposed
Aesto says the data included full names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers, other government ID numbers and Social Security numbers.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
HIPAA Journal reports that 29 healthcare providers are indirectly affected, including VillageMD, Everside Health (Marathon Health), Marana Health and Together Women’s Health. Notifications to individuals began on August 21 with 24 months of Experian identity protection. No threat group has publicly claimed the attack.
Why This Is An Operations Problem
Data archiving vendors hold records from systems their clients have already retired, so patients may not know the vendor exists. More than eight months passed between the intrusion and individual notification. BleepingComputer lists similar incidents at other health-tech software firms, including iRhythm, CareCloud and McKesson.
What To Verify First
- List vendors that hold archived or migrated patient data, including data from retired EHR systems.
- Check contracts for breach-notification timelines and data-retention limits for archived records.
- Prepare patient communication and support for fraud using Social Security and insurance data.
- Ask archive vendors how cloud access to stored records is logged and reviewed.
What Teams May Be Underestimating
Archived data feels dormant, but it is often the most complete copy of a patient’s record. Retention decisions made during a system migration can decide the size of a breach years later.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
