Aesto Health Data Breach Exposes 9.5 Million Patients' Information

A data breach at Aesto Health, a healthcare technology company in Birmingham, Alabama, was discovered on December 18, 2025. The breach affected at least 9.5 million patients, with compromised data including names, Social Security numbers, and medical information. The unauthorized access occurred between December 2 and December 18, 2025, involving parts of Aesto's Amazon Web Services infrastructure. Aesto Health engaged cybersecurity experts to investigate and confirmed the breach on May 26, 2026. Notifications to affected healthcare provider clients began on June 26, 2026. The breach is now reported to the HHS’ Office for Civil Rights, marking it as the second-largest healthcare data breach of the year. Aesto has stated there is no evidence of identity theft or financial fraud related to this incident. The company continues to evaluate its security practices to prevent future incidents.

Key Points: • 9.5 million patients affected by Aesto Health data breach. • Compromised data includes Social Security numbers and medical information. • Breach discovered on December 18, 2025, and reported to HHS in August 2026.