Almeida Law Group is investigating a data breach at G.I. Medicine Associates, P.C. If you were affected, contact Almeida Law Group.
About G.I. Medicine Associates, P.C.
G.I. Medicine Associates, P.C. (GIMA) is a gastroenterology practice with offices in St. Clair Shores and Macomb, Michigan. Founded in 1970, it is described as the largest and most prominent gastroenterology practice in the northeast Detroit metropolitan area. The practice provides diagnostic and treatment services for conditions of the gastrointestinal tract, liver, and pancreas, including colonoscopies, colon cancer screenings, and capsule endoscopies. Because GIMA is a healthcare provider, it maintains medical records and Social Security numbers for its patients — exactly the categories of data reported as compromised in this incident.
What Happened?
G.I. Medicine Associates, P.C. was listed in a Vermont Attorney General breach report summary dated September 18th, 2026, with Social Security numbers and health records identified as the categories of data involved.
This breach did not originate from a direct attack on GIMA. It stems from a cybersecurity incident at Aesto Health (Aesto, LLC), a Birmingham, Alabama-based vendor that provides healthcare data migration and archiving services. On or about December 18th, 2025, Aesto detected unauthorized activity affecting a portion of its Amazon Web Services infrastructure. Forensic investigation confirmed that unauthorized access — and possible data exfiltration — occurred between December 2nd, 2025 and December 18th, 2025. Aesto notified GIMA on June 26th, 2026, and GIMA received its list of impacted patients on July 15th, 2026. According to GIMA’s notification letter filed with the Massachusetts Attorney General, data exposed may have varied by individual and could include full names, addresses, telephone numbers, dates of birth, medical record numbers, and Social Security numbers.
The Aesto Health breach is one of the largest healthcare data incidents disclosed in 2026, affecting more than 9.5 million individuals across at least 37 healthcare provider clients. No ransomware group has publicly claimed responsibility for the attack. Multiple law firms, including Edelson Lechtzin LLP and attorneys at ClassAction.org, are investigating the broader Aesto Health incident for potential class action litigation, though no lawsuit specifically naming GIMA has been filed as of reporting.
Key Facts at a Glance
- Company or Organization: G.I. Medicine Associates, P.C. (GIMA)
- Industry: Health Care – Gastroenterology
- Location: St. Clair Shores and Macomb, Michigan
- Incident type: Unauthorized access and possible data exfiltration at third-party vendor (Aesto Health)
- Date of breach: December 2nd, 2025
- Date breach discovered: December 18th, 2025
- Date of consumer notification: June 26th, 2026 (Aesto notified GIMA); July 15th, 2026 (GIMA received impacted patient list)
- Total persons affected: Part of a broader Aesto Health breach affecting over 9.5 million individuals across at least 37 healthcare provider clients
- Litigation status: No lawsuit specifically naming GIMA found; multiple law firms investigating the broader Aesto Health breach for potential class action
- Source: Vermont Attorney General breach report summary; Massachusetts AG Data Breach Notification – GIMA Breach Letter; Aesto Health – Notice of Data Security Incident; SecurityWeek; BleepingComputer; HIPAA Journal
What Should You Do?
If you received a notice from G.I. Medicine Associates, P.C., review any identity theft protection enrollment offer included with the notice and sign up before the deadline if one applies to you. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your credit reports regularly at AnnualCreditReport.com and watch your existing financial accounts for suspicious activity. Because health records were involved in this breach, carefully review any Explanation of Benefits statements from your health insurer and request copies of your medical records to check for services you do not recognize. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step guidance on recovering from identity theft.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
