Your Doctor Used This Company to Store Your Records. Hackers Took 9.5 Million of Them.

The Company You've Never Heard of That Held Your Most Sensitive Data

You didn't choose Aesto Health. You never signed up for their service, never agreed to their terms, probably never saw their name until a letter showed up in your mailbox this August. But if you visited any of 30-plus medical practices or hospitals that hired them, Aesto Health had your Social Security number, your medical history, and your bank account details sitting in their cloud systems.

That's how the modern healthcare supply chain works. Your doctor doesn't manage your records alone. They outsource that to a vendor, who outsources storage to Amazon Web Services, and somewhere along that chain your most sensitive information lives in a place you've never seen and a company you've never heard of.

What Does Aesto Health Actually Do?

Aesto Health is an IT vendor. Their job is to store and migrate electronic health records on behalf of medical practices and hospitals. When a clinic moves to a new software system, or needs to archive old patient data, they call a company like Aesto. The records get uploaded to the cloud, managed by Aesto's team, and your doctor gets on with seeing patients.

It's an entirely normal part of how healthcare IT works. Most large medical systems use vendors like this. Most patients have no idea.

What Happened Between December 2 and 18, 2025?

Hackers gained access to Aesto's Amazon Web Services infrastructure. They had at least 16 days inside the system. During that window, they pulled data belonging to 9,540,683 people, making this the second-largest confirmed U.S. healthcare breach of 2026.

The stolen information includes:

• Full names
• Social Security numbers
• Dates of birth
• Driver's license numbers
• Medical records
• Health insurance details
• Financial account numbers

That is not a partial picture of someone's identity. That is the full picture. With that combination of data, someone can open credit accounts in your name, file fraudulent tax returns, impersonate you to insurers, or sell your information to other criminals.

Eight Months. Then a Letter.

Aesto discovered the breach in December 2025. Patient notification letters were dated August 21, 2026, more than eight months later.

Federal law under HIPAA requires breach notifications to be sent within 60 days of discovery. Aesto missed that window by a wide margin, and multiple class-action lawsuits have already been filed in response.

Eight months is a long time for stolen data to move through criminal networks. By the time you got that letter, your information may have already been bought, sold, and used.

Aesto is offering affected individuals 24 months of free credit monitoring through Experian IdentityWorks. That is the standard response. It helps, but only if you act on it.

What Should You Do Right Now?

The most powerful tools available to you are free and take less than an hour. Don't wait for something bad to happen first.

1. Freeze your credit at all three bureaus. Go directly to Equifax, Experian, and TransUnion and place a security freeze on your file. This is free. It prevents new credit accounts from being opened in your name without your knowledge. A freeze is stronger than monitoring, monitoring tells you after the fact, a freeze blocks the action.

2. Activate the Experian offer if you received a notification letter. The 24-month IdentityWorks enrollment is free. Use it. It won't stop all fraud but it adds a layer of alerting.

3. Check your Explanation of Benefits (EOB). If your insurer sends you EOBs after medical visits, review them. Medical identity theft, where someone uses your insurance to receive care, is harder to spot than financial fraud. Look for claims you don't recognize.

4. File your taxes early this season. Tax fraud using stolen SSNs is common after large breaches. Filing early reduces the window for someone to file a fraudulent return under your name first.

5. Enable two-factor authentication on financial accounts. If you're not already using it, turn on 2FA for your bank, brokerage, and any account tied to your financial life. Passkeys are even better where your bank supports them, they are phishing-resistant in a way that SMS codes are not.

6. Consider a data removal service. Your information sits in dozens of data broker databases even before a breach. Services like DeleteMe or Kanary will submit removal requests on your behalf. It reduces your overall exposure for future incidents.

The Deeper Problem No Letter Will Fix

Here's the uncomfortable reality: you had no say in any of this.

You chose your doctor. You did not choose Aesto Health. You did not consent to your SSN being stored on their AWS servers. You did not negotiate their security practices or review their incident response timeline. You found out eight months after the fact because that's how the system works.

Healthcare data flows through layers of vendors, subprocessors, and cloud providers, and patients sit at the end of that chain with no visibility and no leverage. The regulations that govern these vendors exist, but enforcement is slow and fines are rarely proportional to the harm caused.

What protects you most right now isn't a policy change or a lawsuit outcome. It's the concrete steps above, taken today, before the next letter arrives.

Do this now:

• Freeze your credit (Equifax, Experian, TransUnion), it's free
• Enroll in Experian IdentityWorks if you received a notification letter
• Review recent EOBs for unfamiliar medical claims
• Turn on 2FA or passkeys for financial accounts
• File your taxes as early as possible this season

Sources

• securityweek.com
• bleepingcomputer.com