The Aesto Health breach: 9.5 million patients, one vendor

For just over two weeks in December 2025 someone had access to part of the Amazon Web Services environment where Aesto Health, a Birmingham, Alabama company, keeps patient records for its clients. Aesto spotted it on 18 December. Working out whose data was involved took until 26 May 2026, because the review included reading the documents themselves, and the company began telling its client providers on 26 June. The patients came last: letters started arriving in the second half of August, roughly eight months after the intrusion, and the federal breach portal now puts the count at 9,540,683 people. Aesto says it has seen no evidence of identity theft or fraud linked to the incident. No group has claimed it.

Aesto’s business is data migration, legacy archiving and record exchange between electronic health record systems. When a practice switches to a new system, the old records have to go somewhere, and a company like this keeps them readable. So the patients in this file are not only current ones: anyone whose chart was moved or archived through Aesto can be in it, including people who stopped seeing that provider long ago. That is why the letter arrives with the name of a hospital or women’s clinic on the envelope, and why there is no Aesto account anywhere for you to log into or secure.

The reported fields are close to a complete identity: name, date of birth, Social Security or taxpayer identification number, driver’s licence or other government ID, health insurance details, financial account numbers, and medical information including diagnoses and claims history. Each piece is a different kind of problem. The Social Security number opens new credit and tax refunds in your name. The insurance details are enough to bill treatment you never had. The account numbers support payment fraud and very convincing calls from “your bank”. None of it can be reset the way a password can, which is why the steps below are about locking things down rather than changing anything.

Freeze your credit at Equifax, Experian and TransUnion; it is free, takes a few minutes online at each, and blocks new accounts opened with your number. Request an IRS Identity Protection PIN at irs.gov, since a stolen Social Security or taxpayer ID number is how fraudulent returns get filed. Enrol in the monitoring your letter offers before its deadline. Read the next few explanation-of-benefits statements from your insurer line by line, looking for visits or prescriptions that are not yours. And if the letter lists a financial account, ask the bank to watch it, or to replace the number. Our medical data breach guide covers the insurance and medical-records side in more detail.

A breach this size is news, and the news is the script. Expect calls from someone claiming to be your clinic’s billing office or Aesto itself, offering to “verify your identity” or “activate protection” if you read out your Social Security number. Expect texts pointing to claim sites that are not run by any court, and lawsuit ads that ask for more than a lawyer needs. The genuine parties already hold your details and do not ring you to collect them. If a message wants your number, your insurance ID or a one-time code, hang up and call back on a number you looked up yourself.

Law firms including Edelson Lechtzin have announced investigations, which is the normal first step and does not mean a case has been filed or money set aside. If a class action is filed and later settles, a court-approved administrator runs the claims process, usually many months later, and the payouts depend on documented losses and time spent. Keep the letter, and keep notes of anything you do in response, such as freezes, calls or fraud reports, with dates. Our settlement claims guide explains what that paperwork is worth once a claim window opens.

A Social Security number and a date of birth stay the same for life, so this file stays useful to whoever has it long after the news fades. What you can shrink is everything that sits next to it. Your address, phone number and relatives are already listed on people-search and data-broker sites, and those listings are how a stolen number gets matched to a person who can be phoned, mailed or impersonated. Taking them down, and checking that they stay down, is the step with the longest effect. For the full sequence after any breach, see our post-breach guide, and for reading the notice itself, the notification-letter guide.