Aesto Health Breach Exposes 9.5 Million Patient Records

Somewhere inside Aesto Health's cloud storage, an intruder spent roughly two weeks quietly copying files before anyone noticed — and it took the company another five months to work out exactly what had been taken. The final number, filed with US health regulators this year: 9,540,683 people.

A breach at a company most patients have never heard of

Aesto Health isn't a hospital or a clinic. It's a background player — a Birmingham, Alabama-based vendor that handles electronic health record migrations and data exchange for hospitals and medical practices. Most of the affected patients probably never dealt with Aesto directly; their data simply passed through its systems at some point, which is exactly why this kind of breach is so hard to see coming as a patient.

The timeline, based on Aesto's own disclosures, runs like this: unauthorized access to a portion of its Amazon Web Services infrastructure — the rented cloud servers where it stores and runs patient data, rather than physical servers it owns — between roughly December 2 and December 18, 2025. The intrusion was spotted on the last of those days. A forensic investigation then took over five months to confirm the full scope, wrapping up on May 26, 2026. Notifications to affected individuals only started going out on June 26, 2026 — more than six months after the actual intrusion.

"On or about December 18, 2025, Aesto experienced a network security incident that impacted a limited portion of our Amazon Web Services infrastructure." — Aesto Health, official breach notice

What actually got taken

This wasn't just email addresses or passwords. The data pulled from Aesto's systems, according to its own filing with the US Department of Health and Human Services, included:

• Full names and dates of birth
• Social Security numbers (for a smaller subset of patients)
• Driver's license and taxpayer ID numbers
• Financial account details
• Health insurance information and medical records — what regulators call protected health information, or PHI, meaning any health-related data tied to an identifiable person

At least two dozen healthcare provider clients across multiple US states were caught up in the incident, which HIPAA Journal has flagged as the second-largest confirmed healthcare data breach of the year so far. Aesto says it has found no evidence yet of identity theft or financial fraud linked to the stolen data, though several law firms have already started soliciting patients for potential class-action lawsuits.

The question nobody's answering

What Aesto hasn't said, even in its formal notices, is how the intruder actually got into its AWS environment in the first place. There's no mention of a stolen password, a leaked access key, a misconfigured storage bucket, or a software flaw — the company has simply confirmed that unauthorized access happened. That silence is fairly typical for breaches like this one, and it's part of a pattern security researchers keep flagging in healthcare cloud incidents: the entry point is rarely some exotic hack and usually traces back to compromised credentials sitting somewhere they shouldn't be, often at a vendor rather than the hospital itself.

Why this matters beyond Alabama

India doesn't run on HIPAA, but it's building something structurally similar at speed. The Ayushman Bharat Digital Mission is steadily linking hospitals, clinics, and individual health records under unified digital health IDs, with private health-tech vendors doing much of the underlying data plumbing — the same role Aesto plays in the US system. A breach at one mid-sized vendor exposing records tied to dozens of hospitals is precisely the failure mode that model is exposed to as it scales.

Health data also sits in the strictest tier of India's own privacy law. Under the Digital Personal Data Protection Act, medical records count as data requiring extra care, and companies handling it are expected to report breaches to the Data Protection Board without the kind of six-month gap Aesto's patients experienced. Whether that reporting timeline actually holds up under pressure is still untested — India's DPDP framework is new enough that nobody has seen it stress-tested by a breach this size yet. Readers who want the fuller rundown on what the law actually requires can find it in our earlier explainer on the DPDP Act.

The real lesson from Aesto isn't that one obscure vendor got hacked. It's that handing patient data to a specialized third party doesn't remove the risk — it just moves it one layer down the supply chain, out of sight until a forensic report surfaces it months later. As India's own digital health infrastructure scales up through exactly this kind of vendor arrangement, the quiet audits need to happen before a breach forces them, not after.