Aesto Health (Birmingham, Alabama), which provides healthcare data migration and archiving for covered-entity clients, posted a notice dated 24 June 2026: it discovered a network security incident on or about 18 December 2025 affecting a limited portion of its Amazon Web Services infrastructure. On 26 May 2026 the investigation determined that PII and PHI belonging to patients of various clients may have been accessed or acquired between about 2 and 18 December 2025, including names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government IDs, and Social Security numbers (elements varied; SSNs for a limited number of people).

The company says it has no evidence of identity theft or financial fraud tied to the incident. No Australia link is reported.

Updated 1 Sep 2026 (BleepingComputer): BleepingComputer reports that in a report to the US Department of Health and Human Services, Aesto Health said the breach affects 9,540,683 individuals, and that Aesto began notifying affected people on 21 August. (source: BleepingComputer)

Correction (27 Oct 2026): the card date has moved from 31 August to 24 June 2026, the date on Aesto's notice; the SecurityWeek link, the HHS listing date and a count of affected provider clients that only SecurityWeek gave have been removed, and the 9,540,683 figure is now credited to BleepingComputer. (source: BleepingComputer)