What Is This About?

If you received a letter or email about a data breach from Aesto, LLC d/b/a Aesto Health (“Aesto”) of Alabama – or from another organization about the Aesto Health data breach – your sensitive personal information or protected health information may have been compromised in a recent data breach. Our firm is investigating this incident and can help you understand your rights and potential legal options.

What Happened?

On or about December 18, 2025, Aesto Health, a company that provides healthcare data migration and archiving services for clients that include healthcare providers, experienced a network security incident affecting a portion of its Amazon Web Services infrastructure. Upon detection, Aesto Health contained the incident and commenced a thorough investigation with the assistance of cybersecurity experts. The investigation confirmed, on May 26, 2026, that between about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Aesto Health clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor.

On June 26, 2026, Aesto notified its Covered Entity (i.e. providers, health plans, or healthcare clearinghouses under HIPPA) clients whose patient information was included in the potentially accessed or acquired files. Aesto Health has posted a public notice of the incident to its website, along with a list of affected Covered Entity clients. Other clients of Aesto whose patients are believed to have been affected are national healthcare companies Village Practice Management Company, LLC (parent of VillageMD/Village Medical), who submitted an Aesto breach notice to the Massachusetts OCABR, and Everside Health, who submitted the same to the California Attorney General. On July 31, 2026, Aesto Health itself reported the breach to the Vermont Attorney General.

What Information Was Impacted?

According to Aesto Health’s public notice and filings, the following categories of information may have been compromised:

• Name;
• Date of birth;
• Medical information;
• Health insurance information;
• Social Security number/taxpayer identification number;
• Driver's license or other government identification number; and
• Financial account number.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected users are entitled to compensation. If you received a notice from Aesto Health, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.