---
title: "Aesto Health cloud-data incident"
description: "Aesto, LLC reported a security incident affecting part of its Amazon Web Services infrastructure around December 18, 2025."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/aesto-health-cloud-data-incident-2025"
markdown_url: "https://www.ally.security/incidents/aesto-health-cloud-data-incident-2025.md"
stix_url: "https://www.ally.security/incidents/aesto-health-cloud-data-incident-2025/stix.json"
---

# Aesto Health cloud-data incident

Aesto, LLC reported a security incident affecting part of its Amazon Web Services infrastructure around December 18, 2025.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Healthcare migration and archiving infrastructure hosted on AWS
- **Operational impact:** Personal information potentially accessed or acquired
- **Financial impact:** No incident cost disclosed

## What happened

[Aesto, LLC](https://www.aestohealth.com/) reported a security incident affecting part of its [Amazon Web Services](https://aws.amazon.com/) infrastructure around December 18, 2025. [1](#source-1)

## Impact

On May 26, 2026, Aesto concluded that personal information may have been accessed or acquired between December 2 and December 18, 2025. [1](#source-1)

The notification template identifies names but leaves other affected fields and healthcare-provider identities variable. It does not establish a total affected population. [1](#source-1)

## Timeline

### May 26, 2026 — Potential data impact confirmed

Potential data impact confirmed, according to the published account. [Incident notice](https://oag.ca.gov/system/files/Notification%20Template%20Letter%20for%20Aesto%20Regulator%20Notices_Redacted.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Aesto engaged outside cybersecurity specialists, investigated and reviewed documents, and offered identity monitoring. It reported no evidence of misuse. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/aesto-health-cloud-data-incident-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Aesto, LLC data security notice

official · Aesto, LLC

<https://oag.ca.gov/system/files/Notification%20Template%20Letter%20for%20Aesto%20Regulator%20Notices_Redacted.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Potential data impact confirmed: 2026-05-26
2. **Resulted In · 100% confidence · current**  
   Aesto Health cloud-data incident: The notification template identifies names but leaves other affected fields and healthcare-provider identities variable. It does not establish a total affected population.
3. **Affected Organization · 100% confidence · current**  
   Aesto Health cloud-data incident: Aesto, LLC
4. **Resulted In · 100% confidence · current**  
   Aesto Health cloud-data incident: On May 26, 2026, Aesto concluded that personal information may have been accessed or acquired between December 2 and December 18, 2025.
5. **Resulted In · 100% confidence · current**  
   Aesto Health cloud-data incident: Aesto engaged outside cybersecurity specialists, investigated and reviewed documents, and offered identity monitoring. It reported no evidence of misuse.
6. **Resulted In · 100% confidence · current**  
   Aesto Health cloud-data incident: Aesto, LLC reported a security incident affecting part of its Amazon Web Services infrastructure around December 18, 2025.
7. **Resulted In · 100% confidence · current**  
   Aesto Health cloud-data incident: Potential data impact confirmed

</details>