Loading story…
Aesto Health, a US healthcare data migration and archiving provider, disclosed that an unauthorized actor accessed a limited portion of its Amazon Web Services environment and may have acquired personal information and protected health information for 9,540,683 individuals. The activity occurred between December 2 and December 18, 2025; the company detected unauthorized activity on December 18 and concluded following forensic investigation and document review on May 26, 2026, that data had been exfiltrated during that period.
The breach affects data supplied by at least two dozen healthcare-provider clients across multiple US states, some of which have issued their own notifications to potentially affected patients. Aesto said it notified impacted provider customers and reported the incident to the US Department of Health and Human Services, but it has not identified the threat actor, entry method, affected AWS resource, or volume of stolen data. The company said it has no evidence so far of resulting identity theft or financial fraud.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
Aesto began notifying healthcare-provider clients whose patient information may have been involved; several providers subsequently issued their own notifications.
Aesto Health publicly disclosed the breach involving its AWS infrastructure and potentially exposed healthcare and personal data.
Aesto concluded that an unauthorized actor had accessed and/or acquired protected health information and personally identifiable information in its environment.
Aesto Health detected unauthorized activity affecting a limited portion of its AWS environment, contained the incident, and engaged external cybersecurity specialists to investigate.
An unauthorized actor accessed portions of Aesto Health's AWS environment between December 2 and December 18, 2025, and exfiltrated personal and protected health information.
Reporting identified at least 30 healthcare organizations affected by the Aesto breach, including Together Women’s Health, for which Aesto filed breach notices in Texas and California. This expands the known organizational impact beyond the at-least-two-dozen clients previously reported.
Aesto reported the breach to the U.S. Department of Health and Human Services as affecting 9,540,683 individuals. The incident involved data associated with at least two dozen healthcare-provider clients.
Following detection of the AWS intrusion, Aesto secured the affected data center and notified relevant law-enforcement authorities. It said potentially exposed data could include medical, insurance, financial-account, and government-identification information, including Social Security numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourcethecyberthrone.in
Open sourcesecurityweek.com
Open sourceaestohealth.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare-sector data breaches were disclosed with significant exposure of **protected health information (PHI)**. TriZetto Provider Solutions (TPS), an insurance verification provider, reported a compromise that began in **November 2024** and was not detected until nearly a year later; the threat was reportedly eradicated on **Oct. 2, 2025**. Notifications to affected healthcare provider customers across several states continued into late 2025 and early 2026, with one Oregon advisory estimating exposure affecting **more than 700,000 people**; impacted providers stated there was no current evidence of misuse and that **financial details were not stolen**. Separately, Healthcare Interactive (*HCIactive*), an AI-powered insurance enrollment and benefits administration vendor, confirmed that an intrusion and data exfiltration tied to activity in mid-2025 ultimately affected **3,056,950 individuals**, after earlier placeholder reporting while scope was still being determined; reported unauthorized access windows vary from **July 8–12, 2025** to a broader **June 17–July 22, 2025**. Another incident involved AI care-coordination platform *Lena Health*, where a threat actor claimed exposure of patient data (including references to a **Twilio call recording database**) and alleged that **2,134 patients’ PHI** was stored in an unencrypted export in a public-facing **AWS S3 bucket**, with follow-on reporting indicating exploitation after a publicly disclosed vulnerability and an available patch that was not applied in time.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly **345,000 to 350,000** people in the United States. The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to **24 months** of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Aug 2, 2026