Major Data Breach at Aesto Health: Over 9.5 Million Patients Affected

Aesto Health, a SaaS provider specializing in medical data migration and archiving, disclosed a massive data breach impacting over 9.5 million patients. The incident stemmed from an AWS infrastructure hack in December 2025, which went undetected until May 2026.

According to an internal investigation, unauthorized access to protected health information occurred between December 2 and 18, 2025. Compromised data included full names, birth dates, medical records, driver’s license numbers, financial details, insurance data, tax IDs, and Social Security numbers.

As stated in the official announcement, the breach affected 29 Aesto Health clients, including major U.S. healthcare organizations such as VillageMD, Everside Health (Marathon Health), Marana Health, and Together Women’s Health. The company began notifying affected patients on August 21, offering them a two-year subscription to Experian’s identity theft protection services.

This incident is part of a growing trend of cyberattacks targeting healthtech companies. Similar breaches were previously reported by iRhythm, Xolis, Medtronic, MCBS, and others. As of publication, no hacker group has claimed responsibility for the attack on Aesto Health.