[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fylfRFt9dOOroRkBFCQ9znDMZujv1-pH8bF7X1Hx43IQ":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"eaafae61-b0d4-43e7-8cf0-96345d704ca2","Aesto Health says data breach affects over 9.5 million patients","aesto-health-says-data-breach-affects-over-9-5-million-patients-c0d143","Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. [...]","Aesto Health, a healthcare software provider, has disclosed a data breach impacting over 9.5 million individuals. The incident, which occurred between December 2025 and May 2026, involved unauthorized access to sensitive patient data including names, dates of birth, medical information, and Social Security numbers. The breach indirectly affects 29 healthcare providers and impacted individuals are being offered identity theft protection services.","Aesto Health data breach exposes personal and health information of over 9.5 million patients.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Faesto-health-says-data-breach-affects-over-95-million-patients\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F01\u002F03\u002Fhealthcare.jpg","2026-09-01T19:28:17+00:00","2026-09-01T20:00:27.843787+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Aesto Health","vendor",{"name":21,"type":22},"Amazon Web Services","product",{"name":24,"type":19},"Experian",{"name":26,"type":19},"VillageMD",{"name":28,"type":19},"Everside Health",{"name":30,"type":19},"Marathon Health","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":31,"icon":33,"name":34,"slug":35},null,"Breaches","breaches",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,24,26],{"controls":52,"vendors":140},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":83,"name":84,"problem":85,"products":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":112,"name":113,"problem":114,"products":115},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":158},"95-million-patients-exposed-in-aesto-health-software-breach","9.5 Million Patients Exposed in Aesto Health Software Breach","A months-long unauthorized access incident at Aesto Health — a third-party healthcare software provider — exposed sensitive data for over 9.5 million patients across 29 healthcare organizations, highlighting the cascading risk of supply chain vulnerabilities in healthcare IT. The breach persisted undetected from December 2025 to May 2026, suggesting critical failures in access controls and continuous monitoring. Because the compromised data includes Social Security numbers, dates of birth, and medical records, affected individuals face compounded risks of identity theft and medical fraud. This incident underscores that healthcare organizations are only as secure as their third-party vendors, making vendor risk management a patient safety issue, not just an IT concern.",[146,147,148,149,150,151,152,153,154,155,156,157],"NIST CSF DE.CM-7 (Monitoring for Unauthorized Activity)","NIST SP 800-171 3.1.1 (Least Privilege Access Control)","HIPAA Security Rule 45 CFR § 164.308(a)(1) (Risk Analysis)","HIPAA Breach Notification Rule 45 CFR §§ 164.400–414","CIS Control 6 (Access Control Management)","CIS Control 15 (Service Provider Management)","CIS Control 17 (Incident Response Management)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 SI-4 (System Monitoring)","GDPR Article 28 (Processor Obligations \u002F Vendor Contracts)","GDPR Article 33 (Breach Notification to Supervisory Authority)","ISO\u002FIEC 27001 A.15.1 (Supplier Relationships)",{}]