Aesto Health says data breach affects over 9.5 million patients
Aesto Health data breach exposes personal and health information of over 9.5 million patients.
Aesto Health, a healthcare software provider, has disclosed a data breach impacting over 9.5 million individuals. The incident, which occurred between December 2025 and May 2026, involved unauthorized access to sensitive patient data including names, dates of birth, medical information, and Social Security numbers. The breach indirectly affects 29 healthcare providers and impacted individuals are being offered identity theft protection services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Aesto Health?
Get an email when a new story names Aesto Health, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA months-long unauthorized access incident at Aesto Health — a third-party healthcare software provider — exposed sensitive data for over 9.5 million patients across 29 healthcare organizations, highlighting the cascading risk of supply chain vulnerabilities in healthcare IT. The breach persisted undetected from December 2025 to May 2026, suggesting critical failures in access controls and continuous monitoring. Because the compromised data includes Social Security numbers, dates of birth, and medical records, affected individuals face compounded risks of identity theft and medical fraud. This incident underscores that healthcare organizations are only as secure as their third-party vendors, making vendor risk management a patient safety issue, not just an IT concern.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.