Aesto Health breach exposes health data of over 9.5 million individuals after AWS intrusion

U.S.-based health‑technology firm Aesto Health announced a significant data breach that compromised personal and medical information belonging to more than 9.5 million people. The company said the breach stemmed from unauthorized access to its Amazon Web Services (AWS) environment, allowing attackers to retrieve a large volume of sensitive records.

According to the disclosure, the attackers were able to infiltrate the cloud infrastructure that hosts Aesto Health's patient management and analytics platforms. Once inside, they extracted data that includes names, dates of birth, contact details, and health‑related information. The breach was identified internally, prompting the firm to shut down the affected systems and engage external cybersecurity experts to assess the scope of the incident.

The scale of the exposure places the incident among the larger healthcare data breaches in recent years, underscoring the sector’s ongoing vulnerability to cloud‑based attacks. Health information is especially prized on underground markets because it can be used for identity theft, insurance fraud, and targeted phishing campaigns. Regulators such as the U.S. Department of Health and Human Services (HHS) are likely to scrutinize the incident under the Health Insurance Portability and Accountability Act (HIPAA) breach notification rules.

Aesto Health, which provides digital tools for patient engagement and data analytics, said it is notifying affected individuals and offering free credit‑monitoring services where applicable. The company also indicated that it is cooperating with law‑enforcement agencies and has reported the breach to relevant federal authorities.

Industry observers note that the incident highlights the importance of robust cloud security configurations, including proper identity and access management, network segmentation, and continuous monitoring. While AWS offers a shared‑responsibility model, the onus remains on customers to implement safeguards that prevent unauthorized entry.

Experts suggest that the breach could prompt a reevaluation of risk‑management practices across the healthcare technology sector. Organizations may accelerate adoption of zero‑trust architectures and increase investment in third‑party audits to verify that cloud deployments meet stringent privacy standards.

As the investigation continues, Aesto Health has pledged to provide updates to stakeholders and to take corrective actions aimed at preventing future incidents. The breach serves as a reminder that as more health data migrates to the cloud, the stakes for protecting that information grow correspondingly.