Aesto Health Cyberattack Exposes 9.5 Million Patients' Sensitive Data

Scope of Compromised Information and Affected Clients

Aesto Health suffered a major cyberattack in December 2025, compromising the personal and financial information of over 9.5 million patients. The breach involved names, Social Security numbers, banking details, and comprehensive health records. More than two dozen of the company’s healthcare clients were also impacted, raising concerns about systemic vulnerabilities in medical data systems.

The incident occurred when unauthorized actors breached Aesto’s Amazon Web Services (AWS) infrastructure, gaining access to sensitive patient databases. Investigators believe the attackers exploited weaknesses in cloud security configurations, allowing them to exfiltrate vast amounts of data over an extended period. Aesto confirmed the breach was detected in early January 2026, prompting immediate remediation efforts.

What Steps Are Being Taken to Address the Breach?

The stolen data included highly sensitive information, such as full names, Social Security numbers, medical histories, and payment details. Over 24 healthcare organizations that relied on Aesto’s services reported disruptions to their operations, with some forced to halt digital transactions temporarily. Industry experts warn that the exposure of SSNs and health records could lead to identity theft and insurance fraud, affecting individuals for years.

Aesto has engaged cybersecurity firms to investigate the attack and strengthen its defenses. The company is collaborating with federal authorities to trace the perpetrators and assess the full scope of the breach. Affected patients have been notified, and credit monitoring services are being offered to mitigate potential harm. Meanwhile, healthcare providers are urged to review their data-sharing protocols with third-party vendors like Aesto to prevent future incidents.

How many patients were affected by the breach? Over 9.5 million patients had their data compromised, including names, Social Security numbers, and health records.

Frequently Asked Questions

What types of organizations were impacted? More than two dozen healthcare clients of Aesto, including hospitals and clinics, were affected by the cyberattack.

What measures are being taken to prevent similar breaches? Aesto is working with cybersecurity experts and law enforcement to improve cloud security and notify all affected parties.