Aesto AWS Breach Exposes 9.5 Million Health Records via Unattributed December Intrusion

Aesto, a Birmingham-based data migration and archiving vendor for EHR transitions and M&A integrations, confirmed the scope after an initial June customer notice. The company filed state breach reports on behalf of at least 30 client organizations, including Together Women's Health. No CVE or exploit details have been released and no group claimed responsibility. The timeline shows a 16-day window of access with no public indicators of compromise or patching records disclosed.

Procurement and incident patterns reveal repeated targeting of healthcare data intermediaries that hold aggregated legacy records rather than frontline providers. Parallel incidents at Baylor Genetics (2.8 million) and CareCloud (3.7 million) this year follow the same vector of large-scale PII and clinical data exfiltration without operational disruption. Aesto's role as a behind-the-scenes archive service amplifies exposure because its datasets persist across multiple EHR migrations.

The evidence trail consists of HHS breach portal filings, state attorney general notices, and Aesto's own limited statements. No independent technical attribution exists beyond the AWS access window; official notifications contain no IOCs or actor fingerprints. This matches the operational profile of financially motivated actors seeking resaleable health datasets rather than state espionage.

Next steps include expected class-action filings and state regulatory scrutiny of Aesto's AWS security controls. Similar vendors should anticipate increased due-diligence demands from hospital systems on data residency and encryption at rest.