December 2025. Sixteen days inside AWS. Nearly ten million patient records exposed.

Between 2 and 18 December 2025, attackers gained unauthorised access to portions of the Amazon Web Services infrastructure run by Aesto Health (Aesto), a Birmingham, Alabama based company that provides secure data migration, electronic health record exchange, and legacy data archiving services to hospitals and medical practices switching systems. Aesto detected the intrusion on 18 December, the day the attackers' access ended, and said it immediately contained the incident and brought in outside cybersecurity investigators.

What followed was a slow drip of disclosure rather than a single reckoning. Aesto first told customers about the incident in a June 2026 notice that gave no indication of scale. Its investigation did not confirm which categories of data had actually been taken until 26 May 2026, five months after the intrusion. It was not until 1 September 2026, when the company formally notified the US Department of Health and Human Services, that the true scope reached the public record: 9,540,683 individuals, spread across at least two dozen healthcare provider clients in several states, some of which chose to notify their own patients rather than wait for Aesto to do it.

Aesto has not disclosed how the attackers got in, and no ransomware or extortion group has publicly claimed the intrusion, so the initial access method remains unconfirmed. What is confirmed is what happened once the attackers were inside: over more than two weeks, they methodically pulled personally identifiable and protected health information out of the environment, including names, Social Security numbers, driver's licence numbers, dates of birth, financial account numbers, medical information, health insurance details and taxpayer identification numbers. That combination is close to the complete toolkit an identity thief needs to open credit lines, file fraudulent tax returns, or bill insurers under someone else's name.

Aesto is not an isolated case. In the same weeks its numbers became public, electronic health record vendor Baylor Genetics disclosed that 2.8 million people had testing and laboratory data stolen in a June intrusion, and CareCloud confirmed that a March breach had grown to affect 3.7 million records. Healthcare's back office, the vendors who migrate, archive, bill and process on behalf of hospitals and clinics, has become one of the softest targets in the sector: broad standing access to patient data across many client organisations, thinner public scrutiny than the hospitals themselves, and breach timelines that routinely stretch to nine months or more before anyone outside the company knows the real number.

None of this points to Aesto running a careless security programme. Cloud infrastructure of this scale is typically wrapped in logging, access reviews and encryption that would pass most audits. What was missing was a control at the one moment that actually mattered: the point at which a large volume of patient records left the environment. A sixteen day export of 9.5 million records, whatever credential authorised it, is not a routine query. It is an execution event, and nothing in Aesto's stack was built to stop it while it was happening, only to reconstruct it afterwards.

GoFirm treats a bulk data export as exactly that: an execution event that requires confirmation before it runs, not a log entry to review once the damage is done. Before any large scale extraction can execute against a production data store, a real time push notification goes to the named data custodian, the individual designated as the confirming authority for that environment, on their registered device. That request requires biometric confirmation on the device itself, over a separate channel from whatever system or credential is requesting the export. No confirmation, no export, regardless of how valid the requesting credentials appear to the cloud platform.

A stolen access key or an abused administrative role can look identical to a legitimate request everywhere a cloud platform checks it. It cannot produce a biometric confirmation on the named authority's registered device through a separate channel. The execution boundary holds regardless of how the access was obtained, or how long the attacker had already been sitting inside the environment before they decided to take the data.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Greig, J. 2026. Health data of more than 9.5 million people leaked from Aesto record system. The Record from Recorded Future News, 2 September 2026.
2. Arghire, I. 2026. 9.5 Million Impacted by Aesto Health Data Breach. SecurityWeek, 1 September 2026.