Aesto Health

Aesto Health, a healthcare technology vendor based in Birmingham, Alabama, disclosed on September 1, 2026 that an incident in its Amazon Web Services environment exposed data on 9,540,683 patients across 29 provider organizations.

The unauthorized access occurred between December 2 and December 18, 2025. Disclosure came roughly nine months after the intruder left. This is the second largest confirmed United States healthcare breach of 2026 so far, behind the 15 million record DentaQuest incident.

Full names, Social Security numbers, partial dates of birth, driver's licence numbers, state identification numbers, financial account numbers, taxpayer identification numbers, health records, medical histories, claims and billing information, and health insurance information.

That list is unusual for its completeness. Most breaches in this series lose one category. This one lost the identity documents, the financial identifiers and the clinical record together, on the same people, which removes the usual mitigation that a victim can at least prove who they are through some channel the attacker does not hold.

Patients of 29 provider organizations who had no relationship with Aesto Health and in most cases have never heard the name. The vendor is a business associate. The patient's relationship was with their doctor.

The practical consequence is that nobody in this set can act on the disclosure without first being told which of their providers used this vendor. Nine months of exposure preceded that notification, during which the data was available and the affected people had no reason to watch for anything.

Running in AWS is the correct architecture for a healthcare technology vendor, and the shared responsibility model is well documented. Aesto was not doing anything unconventional by hosting there.

The failure is not the platform. It is that a sixteen day intrusion in December 2025 produced a disclosure in September 2026, which means detection, scoping or both took the better part of a year. The cloud provider secures the infrastructure. What sits inside the bucket, and whether anybody knows, remains the tenant's problem.

Nine months is the answer to this question, and it is the most complete answer in this series. The intrusion window was sixteen days. Establishing who was in the affected portion of the environment took roughly eighteen times longer than the attack.

The eventual number is exact: 9,540,683. Somebody did the work of counting, eventually, and produced a figure precise to the person. The cost of doing it afterward was nine months of silence for nine and a half million people, across 29 providers who could not notify their own patients until the vendor finished.

The data was in the environment the whole time. The only variable was whether anyone had read it before the attacker did.

No group has claimed this and no leak site listing has been reported. A sixteen day window in a cloud environment with no extortion demand fits quiet data theft rather than ransomware.

That absence is why the timeline ran long. Ransomware announces itself and forces a clock. A silent intrusion is found later, scoped slower, and disclosed on the schedule of whoever is counting.

Knowing what was in that portion of the AWS environment before December 2025. The intrusion lasted sixteen days. The response lasted nine months, and almost all of that was the inventory that had never been built.

A vendor holding Social Security numbers, driver's licence numbers, financial accounts and clinical histories for 29 providers is holding the most heavily regulated combination in American data. The set of files carrying it was finite and enumerable at any point. It was enumerated in 2026, by the wrong party first.