Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Million Records
Attackers accessed part of Aesto Health's AWS infrastructure between December 2-18, 2025, exposing personal and health data of over 9.5 million patients.
Aesto Health, a Birmingham, Alabama healthcare technology company, disclosed a breach affecting 9,540,683 individuals whose protected health information was stored in its AWS infrastructure. Attackers had access from around December 2 to December 18, 2025; the incident was discovered on December 18, 2025 and confirmed on May 26, 2026 after a forensic investigation. Exposed data may include names, birth dates, medical and insurance details, financial account information, government ID numbers and, for a limited number of people, Social Security numbers. Aesto reported the incident to HHS and says it found no evidence of identity theft or financial fraud.
- Attackers accessed a limited portion of Aesto Health's AWS infrastructure for over two weeks
- HHS notified; breach impacted 9,540,683 individuals across multiple healthcare clients
- Data includes names, birth dates, insurance and medical info, financial account details, some SSNs
- Company launched an external forensic investigation and set up a dedicated helpline
- Vendors
- Amazon Web Services
- Victims
- Aesto Health
- Organizations
- Department of Health and Human Services
- Countries
- United States
From the original article
2 min read at securityaffairs.com
Aesto Health suffered a breach exposing personal and health data of more than 9. 5 million people after attackers accessed its AWS infrastructure. Aesto Health, a U.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.