Almeida Law Group is investigating a data breach at Catalyst Physician Group. The breach occurred on December 2nd, 2025. If you were affected, contact Almeida Law Group.
About Catalyst Physician Group
Catalyst Physician Group is a physician-owned, physician-led primary care organization founded in 2024. It unites the practices of Family HealthCare Associates, Village Health Partners, and Northeast Tarrant Internal Medicine Associates (NETIMA), with more than 120 physicians and 500 staff across 21 locations in the Dallas–Fort Worth Metroplex in Texas. The organization offers primary care, pediatrics, sports medicine, chronic care management, behavioral health, and Medicare guidance. Because Catalyst Physician Group handles protected health information for patients across its network, a security incident affecting that data carries meaningful risks for those individuals.
What Happened?
Catalyst Physician Group was listed in a California Attorney General sample breach notice filed on September 11th, 2026. The breach did not originate at Catalyst Physician Group’s own systems. Instead, it occurred at Aesto, LLC (doing business as Aesto Health), a Birmingham, Alabama-based healthcare technology company that provides data migration and archiving services for healthcare organizations, including Catalyst Physician Group.
On or about December 18th, 2025, Aesto detected a network security incident affecting a portion of its Amazon Web Services infrastructure. After a forensic investigation, Aesto confirmed on May 26th, 2026 that unauthorized access had occurred between approximately December 2nd, 2025 and December 18th, 2025. Aesto notified its healthcare provider clients on June 26th, 2026 and first disclosed the incident publicly on June 24th, 2026. Individual notification letters began going out in August 2026, with the Catalyst Physician Group filing reaching the California Attorney General on September 11th, 2026—roughly nine months after the initial intrusion. The notice states that the information potentially involved includes affected individuals’ full names along with additional variable data types not fully specified in the notice template. Based on Aesto’s broader disclosures to the U.S. Department of Health and Human Services and confirmed by multiple sources, the broader Aesto breach involved data types including full names, dates of birth, Social Security numbers, driver’s license numbers, state identification numbers, financial account numbers, taxpayer identification numbers, health records, medical histories, claims and billing information, and health insurance information, though the specific data types for each Catalyst Physician Group patient may vary. No ransomware group or specific threat actor has claimed responsibility for the attack, and the technical root cause has not been publicly disclosed.
The broader Aesto breach is among the largest U.S. healthcare data incidents of 2026. Aesto reported to HHS that 9,540,683 individuals were affected across at least 29 to 36 healthcare provider clients, including VillageMD, Everside Health, Together Women’s Health, SpineZone, and Catalyst Physician Group. No class action lawsuit has been filed specifically naming Catalyst Physician Group in connection with this incident, but multiple law firms are actively investigating the broader Aesto Health breach for potential class action claims on behalf of affected patients across all impacted providers.
Key Facts at a Glance
- Company or Organization: Catalyst Physician Group
- Industry: Healthcare / Primary Care
- Location: Dallas–Fort Worth Metroplex, Texas (21 locations)
- Incident type: Unauthorized access to vendor’s network infrastructure (third-party vendor breach via Aesto Health)
- Date of breach: December 2nd, 2025
- Date breach discovered: December 18th, 2025
- Date of consumer notification: September 11th, 2026 (California Attorney General filing)
- Identity theft protection offered: Yes — complimentary 12 or 24-month IDX membership (credit and CyberScan monitoring, $1,000,000 insurance reimbursement policy, fully managed ID theft recovery services); enroll by calling 1-866-200-0884 or visiting https://app.idx.us/account-creation/protect
- Enrollment deadline: December 11th, 2026
- Litigation status: No filed class action naming Catalyst Physician Group; multiple law firms investigating the broader Aesto Health breach for potential class action claims
- Source: California Attorney General sample breach notice; Aesto Health – Notice of Data Security Incident; BleepingComputer; HIPAA Journal
What Should You Do?
If you received a notice about this breach, take advantage of the complimentary IDX identity protection enrollment by calling 1-866-200-0884 or visiting the IDX enrollment page before the December 11th, 2026 deadline. Regardless of whether you enroll, consider placing a fraud alert or security freeze on your credit files with the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for anyone to open new accounts in your name. Review your financial account statements and obtain free copies of your credit reports at AnnualCreditReport.com. Because protected health information was involved, also review your Explanation of Benefits statements from your health insurer and check your medical records for any services you do not recognize. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
