Aesto Health: 9.54 million people on HHS portal after Dec 2025 AWS infrastructure incident
Aesto Health (Birmingham, Alabama), which provides healthcare data migration and archiving for covered-entity clients, posted a June 2026 notice: it discovered a network security incident on or about 18 December 2025 affecting a limited portion of its Amazon Web Services infrastructure. On 26 May 2026 the investigation determined that PII and PHI belonging to patients of various clients may have been accessed or acquired between about 2 and 18 December 2025, including names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government IDs, and Social Security numbers (elements varied; SSNs for a limited number of people). The US HHS portal lists 9,540,683 individuals; SecurityWeek (1 September) says HHS added the company on Monday 31 August 2026. At least two dozen provider clients across several states were affected. The company says it has no evidence of identity theft or financial fraud tied to the incident. No Australia link is reported.
- Product
- Aesto Health (AWS-hosted migration/archive)
- Exploited in Australia?
- unknown
Primary: Aesto Health notice (June 2026) · Vendor: Aesto Health (company notice) · SecurityWeek (1 Sep 2026)