Aesto LLC, a healthcare IT vendor that processes patient records on behalf of hospitals and medical practices, has disclosed a data breach that affects more than 9.5 million individuals. The company says an unauthorized actor gained access to its network between December 2, 2025, and December 18, 2025, and may have accessed or taken protected health information stored for dozens of covered-entity clients. Aesto completed its forensic investigation and confirmed the breach on May 26, 2026 — more than five months after the intrusion ended.
The types of information exposed vary by patient but can include names, email addresses, Social Security numbers, driver’s license numbers, health insurance information, and medical records. Because Aesto is a third-party vendor that handles data for many healthcare organizations, patients may be notified by their doctor’s office or hospital rather than by Aesto directly. The company is notifying affected individuals as required under HIPAA and applicable state breach-notification laws.
How to check if you’re affected
Affected products are any electronic health record or billing platform operated by Aesto Health on behalf of your healthcare provider. If you received a breach notification letter from a medical provider in the summer of 2026, check whether it mentions Aesto or Aesto LLC as the vendor involved. You can also contact your doctor’s office directly to ask if they use Aesto’s systems.
If your information was exposed, consider placing a free credit freeze with all three major bureaus (Equifax, Experian, TransUnion), monitoring your Explanation of Benefits statements for unfamiliar charges, and being alert to phishing attempts that reference your medical history.