Aesto Health Data Breach Affects Over 9.5 Million Patients

The Aesto Health data breach has affected more than 9.5 million people after an unauthorised actor accessed patient data stored in the company’s network.

Aesto Health provides software services that help healthcare organisations migrate, archive and access patient data when they change electronic health record systems or acquire medical practices.

Attackers accessed sensitive patient information

Aesto Health first disclosed the incident publicly on June 24, saying that attackers had compromised a limited part of its cloud infrastructure.

However, the company later confirmed that the intrusion took place between December 2 and December 18, 2025. External forensic specialists helped investigate the incident, which Aesto confirmed internally on May 26, 2026.

The Aesto Health data breach affected 9,540,683 individuals, according to a report filed with the US Department of Health and Human Services.

Exposed information may include full names, dates of birth, medical information, health insurance details, Social Security numbers and other government identification numbers.

The data may also include driver’s licence numbers, taxpayer identification numbers and financial account numbers.

Breach may affect patients at 29 providers

The incident reportedly affects patients linked to 29 healthcare providers that use Aesto Health services.

Those organisations include VillageMD, Everside Health, Marana Health and Together Women’s Health.

Aesto began notifying affected individuals on August 21. The company is offering 24 months of identity theft protection and credit-monitoring services through Experian.

No ransomware or extortion group has publicly claimed responsibility for the attack.

Healthtech data breaches continue to rise

The Aesto Health data breach adds to a growing number of security incidents involving healthcare technology providers.

Several companies have recently reported breaches affecting millions of patients, including iRhythm, Xolis, MCBS, Unlimited Technology Systems, CareCloud, Nutex Health and McKesson.

Healthcare technology firms often store and process large volumes of sensitive patient records. As a result, successful attacks can expose medical, financial and identity data for millions of people at once.