Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025. Here is what the filings confirm, what is still unknown, and what healthcare organizations should check.
Where United States · North America, United States & Canada
On this page 7 sections
Aesto, a vendor that moves and archives patient records for healthcare providers, says an unauthorized actor may have accessed or taken patient data from its Amazon Web Services environment between about December 2 and December 18, 2025. If your organization hands patient records to an outside company, this is the risk to plan for: South Carolina alone lists 4,508 residents affected, news reports citing a federal filing put the national count above 9.5 million, and Aesto did not start telling its provider clients until June 26, 2026.
What happened in the Aesto data breach
Aesto, LLC, doing business as Aesto Health, is based in Birmingham, Alabama. It helps healthcare organizations migrate, archive and access legacy data during record system changes and acquisitions. In practice, that means it can hold records from systems a provider no longer uses.
The company's notice dated June 24, 2026 says a "network security incident" on or about December 18, 2025 "impacted a limited portion" of its AWS infrastructure. Aesto says it contained the activity when it detected it, then brought in outside cybersecurity experts. We read that notice through the linked copy because the page on Aesto's own site returned "not found" when we checked. The same account appears in letters filed with state regulators.
Aesto breach timeline
| Date | What happened | Where it is recorded |
|---|---|---|
| About Dec. 2 to Dec. 18, 2025 | Window of possible access | Aesto notice |
| May 26, 2026 | Aesto confirms the data involved after forensic and manual document review | Aesto notice |
| June 26, 2026 | Aesto starts notifying provider clients | Aesto notice |
| July 15, 2026 | Aesto gives one client, Allied Health, the affected data and list of people | Allied Health letter |
| July 22, 2026 | Allied Health confirms the scope | Allied Health letter |
| Aug. 25, 2026 | Date on a patient letter for SpineZone | SpineZone letter |
| Oct. 30, 2026 | Date reported on the South Carolina and California lists | State lists |
From December 18 to June 26 is 190 days. SpineZone's letter says Aesto informed it "for the first time" on June 26.
What is confirmed and what is not
Confirmed in filings:
- South Carolina's Department of Consumer Affairs lists Aesto, LLC with 4,508 affected residents.
- Aesto's notice lists full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer ID numbers, other government ID numbers and Social Security numbers. It says the details varied by person and that Social Security numbers were potentially involved for "a limited number of individuals."
- Exposure differs by client. SpineZone's letter says the data "did not include your mental/physical condition, treatment, or medical history."
Reported, but not confirmed by us:
- The total of 9,540,683 people comes from BleepingComputer and SecurityWeek, both citing Aesto's federal report to HHS. The Aesto row was not visible in the part of the HHS portal we could open.
- BleepingComputer, citing HIPAA Journal, counts 29 affected providers. SecurityWeek says at least two dozen.
Not known:
- How the intruder got in. None of the documents we read name a stolen password, a misconfigured setting or a software flaw, so an access control failure has not been established.
- Who did it. BleepingComputer reported on September 1 that no group had claimed the attack.
- Whether the data has been misused. Aesto says it has "no evidence" of identity theft or financial fraud. That is a statement about what it has seen, not proof that nothing happened.
Why a healthcare vendor breach matters for your business
Patients rarely know who stores their old records. When a letter arrives, it often carries the provider's name, so the provider takes the calls and the reputational damage for a system it did not run.
The legal timing also runs through the vendor. Under HIPAA's rule for business associates, a vendor must notify its client "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." A breach counts as discovered on the first day it is known or would have been known with reasonable diligence. Providers then have their own 60-day limit to notify patients.
Whether Aesto met that standard is a legal question. Nothing we read shows a regulator ruling on it, and the answer depends on when the breach counts as discovered. The practical point stands either way: your notification duties depend on how quickly a vendor can tell you who was affected. Allied Health received its list 19 days after first hearing about the incident.
Certificates do not settle this either. Aesto's trust center lists HITRUST and SOC 2 Type 2. We do not know the scope or dates of those reports, or whether any control failed. They are a place to start asking questions, not the answer.
Healthcare vendor security checklist for this week
| Check | What to do or ask | Why it matters |
|---|---|---|
| Are you an Aesto client? | Search contracts and payables for Aesto, including past record migrations | Old projects are easy to forget |
| Vendor inventory | List every company holding patient data, including archives and former record systems | You cannot manage exposure you have not listed |
| Breach deadline | Read each business associate agreement; negotiate a notice period well under 60 days | The law sets an outer limit, not a target |
| Access controls | Ask about multi-factor login for admins, named accounts, least privilege and access reviews | Shared or broad cloud access widens the damage |
| Logging | Ask which events are logged, how long logs are kept, and whether you can get them | Without logs, nobody can say what was taken |
| Data retention | After a migration, get written confirmation of what was deleted and when | Data that is gone cannot be stolen |
| Incident roles | Put in writing who notifies patients, who files with HHS and states, and who pays | Those decisions are hard to make mid-breach |
| Evidence | Request the current SOC 2 Type 2 report and read its scope and exceptions | A logo does not show what was tested |
Aesto data breach questions people are asking
Was my data in the Aesto breach?
A letter is the clearest sign, and it may name your healthcare provider rather than Aesto. Aesto's response line is 833-918-8060, Monday through Friday, 8 am to 8 pm Central, with engagement number B167683.
What information was exposed in the Aesto data breach?
It varies by person. Your letter should list your own data types. Aesto's full list is in the confirmed section above.
How many people were affected by the Aesto data breach?
South Carolina lists 4,508 of its residents. News reports citing Aesto's HHS filing say 9,540,683 nationally.
Is the Aesto breach letter real?
Filed sample letters use Cyberscout, a TransUnion company, or Kroll for monitoring. Compare the phone number in your letter with the one above before sharing anything.
What should I do if I got an Aesto letter?
Enroll in the free monitoring before the deadline in your letter (90 days in the Allied Health and SpineZone letters). Freeze your credit with all three bureaus and check your insurer's explanation of benefits statements for care you do not recognize.
How did hackers get into Aesto?
That has not been disclosed in anything we read.
The bigger lesson
Handing data to a vendor moves the work, not the responsibility. The questions that matter most, how fast you will be told, who can log in, what gets logged and when old data is deleted, are cheapest to ask before a contract is signed.
For help reviewing your vendors, logins and logging, see security hardening or request a quote.
Get security alerts by email, with the free checklist.
Sources: Aesto notice of data security incident (copy); South Carolina Department of Consumer Affairs breach notices; California Attorney General, Aesto filing; Allied Health letter; SpineZone letter; 45 CFR 164.410; Aesto trust center.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store atta...
Binance Hack: $6.3 Billion Taken After Engineers' Laptops Were Compromised, What Is Confirmed and What to Check This Week
Attackers took about $6.3 billion from Binance on October 29. Binance's preliminary findings trace the theft t...
Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week
Attackers changed refrigeration settings at about 700 French retail sites in October, and US agencies now urge...
