Lexington Hospital Corp. , a healthcare organization based in Lexington, Tennessee, recently disclosed a data breach that affected approximately 67,000 people in the United States.
Lexington Hospital Corp. is connected to several affiliated healthcare entities in the region, according to public provider records. These affiliated entities include Henderson County Community Hospital, Henderson County Medical Group and Lexington Family Physicians RHC.
The breach was reported to the U.S. Department of Health and Human Services on Sept. 8, 2026.
The data security incident was connected to Aesto LLC , a third-party vendor that provided data migration, archiving and historical records management services for Lexington Hospital Corp. The breach did not involve a direct attack on the healthcare organization's own internal systems.
Between on or Dec. 2 and Dec. 18, 2025, personal and protected health information stored on Aesto's network may have been accessed or acquired by an unauthorized actor.
At this time, the types of PHI or PII compromised for individuals connected to Lexington Hospital remains undisclosed but may have included information such as names, information, health records, medical information or other information.
Lexington Hospital's response to the breach
Lexington Hospital's response to the breach
Social Security Numbers
Affected information types not yet disclosed
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
