Aesto Health data breach: who Aesto is, and which providers are involved
Aesto moves and archives patient records for healthcare providers. Its report to federal health regulators covers 9,540,683 people, as of 1 November 2026.1,2
Aesto, LLC
c/o Cyberscout
PO Box 1286
Dearborn, MI 48120-9998
August 25, 2026
Aesto, LLC ("Aesto") provides healthcare data migration and archiving services for Together Women's Health LLC and writes with important information regarding a recent data security incident ...
The information potentially impacted includes your full name, as well as your Data elements
... please call our dedicated and confidential toll-free response line ... at 833-918-8060 ... Be prepared to provide your engagement number
Aesto LLC, on behalf of
Together Women's Health LLC
- The return addressCyberscout, a TransUnion company, in Dearborn, Michigan. It runs the monitoring offered in this letter.3
- Why Aesto has your dataYour provider used Aesto to move or archive its records. This sample names Together Women's Health.3
- The response lineWeekdays 8 a.m. to 8 p.m. Central. Aesto's own notice gives the same number.3,2
- Your provider's nameEach letter names the provider it's sent for, so yours tells you which one.3
Drawn from a sample letter filed with California's attorney general for one Aesto client. Checked 1 November 2026 against the sources.
The facts, as filed
"The company says" marks Aesto's own account. A listing here isn't a finding that the company was at fault.
- What happened
- The company says it had a network security incident on or about 18 December 2025 in part of its Amazon Web Services infrastructure. On 26 May 2026 it confirmed that patient data from its clients may have been accessed or taken between about 2 and 18 December 2025.2
- People affected
- 9,540,683 in Aesto's report to the HHS breach portal, filed 31 July 2026 as a business associate, as of 1 November 2026.1
- What leaked
- It varied by person, the company says: names, dates of birth, medical and health insurance information, driver's license and other government ID numbers, taxpayer ID numbers and financial account numbers. Social Security numbers for a limited number of people.2
- Who was told
- Aesto says it began notifying its provider clients on 26 June 2026. Patient letters followed, such as the one dated 25 August 2026 for Together Women's Health.2,3
- Monitoring offer
- In the filed sample: 12 months of single-bureau credit monitoring, credit report and score, plus fraud assistance from Cyberscout, at no charge.3
- Lawsuit
- As of 1 November 2026 we found no court-approved settlement, and no filed lawsuit we could read in a court record.
The 29 providers Aesto names
Aesto's notice is given on behalf of its clients, "including those identified below". Its list was last updated on 6 October 2026.4,2
- West County Health Centers
- G.I. Medicine Associates, P.C.
- Catalyst Physician Group
- Mountrail County Medical Center
- Ninilchik Traditional Council Community Clinics
- My Doctor, LLC
- Sterling Health Solutions
- Henry County Hospital
- Midtown Community Health Center
- Little River Memorial Hospital
- Graham County Hospital
- Missoula Community Health Services Inc., dba Mineral Community Hospital
- Monroe Health Center
- Mid-South OB-GYN, PLLC
- Women's Health Associates, Inc.
- Together Women's Health Medical Group of Alabama, PC
- Together Women's Health Medical Group, PC
- Effingham Obstetrics & Gynecology Associates, PLLC
- Main Street Medical Services, PLLC
- Rural Health Resources of Jackson County Inc. d/b/a Holton Community Hospital
- Park West Health Systems, Inc.
- Marana Health
- Greenwood County Hospital
- Gila Health Resources, LLC
- Edwards County Medical Center
- Ellenville Regional Hospital
- Shenandoah Valley Medical System Inc.
- Texas Spine Consultants, LLP
- Nebraska Orthopedic Center, P.C.
Providers that filed with a state
The list above isn't complete. These filings name Aesto, and three of the providers aren't on Aesto's list.
| Filing, as the state lists it | State | People in that state |
|---|---|---|
| Aesto, LLC (Grant County Public Hospital District #2) | Washington, 4 Aug 2026 | 37,2535 |
| Everside Health (Aesto, LLC) | Washington, 31 Jul 2026 | 21,3085 |
| Together Women's Health LLC (Aesto) | Texas, 28 Aug 2026 | 1,5466 |
| Nebraska Orthopaedic Center (Aesto, LLC) | Washington, 19 Aug 2026 | 9925 |
| Murfreesboro Medical Clinic (Aesto, LLC d/b/a Aesto Health) | Washington, 26 Aug 2026 | 8455 |
What to do if you got an Aesto letter
Match the steps to the data your letter lists. The full checklist covers every data type.
- Enroll in the monitoring your letter offers.Follow the activation steps in your own letter. Call 833-918-8060 with your engagement number if anything is unclear.3
- Social Security or taxpayer ID number listed: freeze your credit.Contact each of the three credit bureaus. A freeze is free to place and to lift, and lasts until you remove it.7
- Get an IRS identity protection PIN.It stops someone else filing a tax return with your Social Security number or taxpayer ID number. It's valid for one calendar year.8
- Read your insurer's statements.Aesto's notice suggests checking your explanation of benefits and asking your insurer for a report of services paid in your name.2
Questions people ask
I've never heard of Aesto. Is the letter real?
Aesto confirms the incident on its own site and gives 833-918-8060 as its response line.2 The filed sample comes from Aesto, LLC c/o Cyberscout in Dearborn, Michigan, and names the provider it's sent for.3 If yours names a provider you've used, you can also call that provider on a number you look up yourself. Our letter check explains the other checks.
Is the Aesto breach from 2025 or 2026?
Both: the access happened in December 2025, the company says, and it confirmed what was involved on 26 May 2026. It began telling its provider clients on 26 June 2026.2
Is there Aesto data breach compensation or a settlement?
We found no court-approved settlement and no filed lawsuit we could read as of 1 November 2026. A real settlement comes with a court-approved notice that names the case. This isn't legal advice.
Sources 8
- Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 1 November 2026.
- Notice of Data Security Incident (24 June 2026), Aesto, LLC d/b/a Aesto Health. Read 1 November 2026.
- Together Women's Health LLC, Aesto: filing and sample notice (reported 25 August 2026), California Attorney General. Read 1 November 2026.
- Covered entities identified (updated 6 October 2026), Aesto Health. Read 1 November 2026.
- Data Breach Notifications, Washington State Office of the Attorney General. Filings naming Aesto, 31 July to 26 August 2026. Read 1 November 2026.
- Data Security Breach Reports, Office of the Texas Attorney General. Together Women's Health LLC (Aesto), published 28 August 2026. Read 1 November 2026.
- Credit freeze or fraud alert: Which is right for you?, Federal Trade Commission. Read 1 November 2026.
- Get an identity protection PIN (IP PIN), Internal Revenue Service. Read 1 November 2026.
Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check