Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Million Records
Attackers accessed part of Aesto Health's AWS infrastructure between December 2-18, 2025, exposing personal and health data of over 9.5 million patients.
Aesto Health, a Birmingham, Alabama healthcare technology company, disclosed a breach affecting 9,540,683 individuals whose protected health information was stored in its AWS infrastructure. Attackers had access from around December 2 to December 18, 2025; the incident was discovered on December 18, 2025 and confirmed on May 26, 2026 after a forensic investigation. Exposed data may include names, birth dates, medical and insurance details, financial account information, government ID numbers and, for a limited number of people, Social Security numbers. Aesto reported the incident to HHS and says it found no evidence of identity theft or financial fraud.