Between December 2 and December 18, 2025, Aesto LLC, a business associate under HIPAA, suffered a data breach that would impact dozens of its covered entity clients. The clients first found out in June, however. Bleeping Computer reports:
Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals.
The private technology company provides software-as-a-service solutions that help healthcare organizations migrate, archive, and access patient data when replacing electronic health record systems or acquiring medical practices.
The company first informed the public of the attack on June 24 via a notification on its website, stating that “a limited portion” of its Amazon Web Services infrastructure had been compromised.
Read more at BleepingComputer.
The following is a list of covered entities known to be affected:
- Edwards County Medical Center
- Effingham Obstetrics & Gynecology Associates, PLLC
- Ellenville Regional Hospital
- Everside Health
- Gila Health Resources, LLC
- Graham County Hospital
- Greenwood County Hospital
- Henry County Hospital
- Kaniksu Community Health
- Little River Memorial Hospital
- Livara Health Medical Group – dba SpineZone
- Lone Star Community Health Center
- Main Street Medical Services, PLLC
- Marana Health
- Mid-South OB-GYN, PLLC
- Midtown Community Health Center
- Missoula Community Health Services Inc., dba Mineral Community Hospital
- Monroe Health Center
- Murfreesboro Medical Clinic
- My Doctor, LLC
- Nebraska Orthopedic Center, P.C
- Park West Health Systems, Inc.
- Quincy Valley Medical Center
- Rural Health Resources of Jackson County Inc. d/b/a Holton Community Hospital
- Shenandoah Valley Medical System Inc.
- Stanislaus County Health Services Agency
- Sterling Health Solutions
- Texas Spine Consultants, LLP
- Together Women’s Health Medical Group of Alabama, PC
- Together Women’s Health Medical Group, PC
- Village Practice Management (VillageMD; Village Medical)
- Women’s Health Associates, Inc.
