Almeida Law Group is investigating a data breach at Aesto LLC. If you were affected, contact Almeida Law Group.
About Aesto LLC
Aesto, LLC, doing business as Aesto Health, is a healthcare technology company headquartered in Birmingham, Alabama. It provides healthcare data migration, archiving, and electronic health record exchange services through a SaaS platform, serving medical practices, independent clinics, hospitals, and investor-backed healthcare groups. Because it functions as a business associate and subcontractor to healthcare providers, Aesto’s systems store protected health information and other sensitive personal data on behalf of its clients. The company holds HITRUST R2 and SOC 2 Type II certifications. Allied Health MSO Holdco, LLC, the healthcare management services organization that filed the California Attorney General notice, is headquartered in West Long Branch, New Jersey, and provides administrative and operational support to specialized medical practices.
What Happened?
Aesto LLC was listed in a California Attorney General sample breach notice filed on behalf of Allied Health MSO Holdco, LLC. According to the notice letter, on or about December 18th, 2025, Aesto experienced a network security incident affecting a limited portion of its Amazon Web Services infrastructure. After an extensive forensic investigation, Aesto confirmed on May 26th, 2026, that an unauthorized actor may have accessed or acquired personal information stored in its network during the window of approximately December 2nd, 2025, through December 18th, 2025. Aesto notified Allied Health on June 26th, 2026. Allied Health received the affected data on July 15th, 2026, confirmed the scope of the impact on July 22nd, 2026, and the consumer notice was reported to the California Attorney General on August 25th, 2026.
The notice letter uses a template variable field for the specific data types involved in the Allied Health notification, so the full list of data elements was not enumerated in the filing itself. However, according to supplemental research, names and Social Security numbers were among the data involved in the Allied Health-specific notification. Aesto’s own published notice for the broader incident confirms that data involved across affected clients could include full names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers, other government identification numbers, and Social Security numbers, with the degree of impact varying by individual. Aesto has stated it has no evidence the information has been misused. No threat actor has been publicly identified, no ransomware group has claimed responsibility, and Aesto has not disclosed a root cause or attack vector. The approximately eight-month gap between the breach window and patient notification has drawn scrutiny. Multiple other healthcare providers were also affected by the Aesto incident, including SpineZone, Everside Health, Aspire Rural Health System, and Quincy Valley Medical Center. Multiple law firms, including Edelson Lechtzin LLP and Cole & Van Note, have announced investigations into potential class action claims, though no filed lawsuits have been confirmed as of the most recent reporting.
Key Facts at a Glance
- Company or Organization: Aesto LLC (d/b/a Aesto Health); affected client: Allied Health MSO Holdco, LLC
- Industry: Healthcare IT / Health Data Management (Business Associate / Subcontractor)
- Location: Aesto LLC — Birmingham, Alabama; Allied Health MSO Holdco, LLC — West Long Branch, New Jersey
- Incident type: Unauthorized access to network infrastructure (Amazon Web Services)
- Date of breach: December 2nd, 2025 – December 18th, 2025
- Date breach discovered: May 26th, 2026
- Date of consumer notification: August 25th, 2026
- Identity theft protection offered: Yes — complimentary credit monitoring and identity theft protection, including a $1,000,000 identity theft insurance policy, provided through Cyberscout (a TransUnion company)
- Enrollment deadline: 90 days from the date of the individual notice letter
- Litigation status: Multiple law firm investigations announced (Edelson Lechtzin LLP, Cole & Van Note, Potter Handy); no filed lawsuits confirmed
- Source: California Attorney General sample breach notice; Aesto Health — Notice of Data Security Incident; HIPAA Journal; Edelson Lechtzin LLP investigation (GlobeNewswire)
What Should You Do?
If you received a notice letter, enroll in the complimentary credit monitoring and identity theft protection services offered through Cyberscout within 90 days of the date on your letter by visiting bfs.cyberscout.com/activate and entering your unique enrollment code. Even if you did not receive a letter, you can place a free fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. You are entitled to a free copy of your credit report from each bureau at AnnualCreditReport.com, and you should review those reports closely for any unfamiliar accounts or activity. Because health information may have been involved, also review any Explanation of Benefits statements from your insurer and request copies of your medical records to check for services you did not receive. Report any signs of fraud or identity theft to the Federal Trade Commission at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
