Almeida Law Group is investigating a data breach at Marana Health Center. The breach occurred on December 18th, 2025. If you were affected, contact Almeida Law Group.
About Marana Health Center
Marana Health Center, Inc., doing business as MHC Healthcare, is a Federally Qualified Health Center (FQHC) headquartered in Marana, Arizona. It operates approximately 13 locations in the Tucson and Marana area, offering services including family medicine, internal medicine, dentistry, pharmacy, behavioral health, and urgent care. Because it is an FQHC handling protected health information for a broad patient population, the exposure of patient records carries significant privacy and identity theft risks.
What Happened?
Marana Health Center was listed in a California Attorney General sample breach notice filed on June 26th, 2026. The breach, however, did not originate at Marana Health Center itself. It occurred at Aesto LLC, doing business as Aesto Health, a Birmingham, Alabama-based healthcare technology vendor that provides SaaS-based data migration, legacy data archiving, and electronic health record exchange services to healthcare providers. Marana Health Center was one of at least 39 Aesto healthcare provider clients whose patient data was affected.
According to Aesto’s notice, a network security incident impacted a limited portion of Aesto’s Amazon Web Services infrastructure between approximately December 2nd, 2025, and December 18th, 2025. Aesto confirmed the breach internally on May 26th, 2026, and notified affected covered entities, including Marana Health Center, on June 26th, 2026. Aesto first posted a public disclosure on its website on June 24th, 2026. Across all 39 or more affected provider clients, the breach was reported to the U.S. Department of Health and Human Services as affecting 9,540,683 individuals, making it the second-largest confirmed U.S. healthcare data breach of 2026. The specific number of Marana Health Center patients affected was not identified in the available notice. The data types exposed across the overall Aesto breach include full names, dates of birth, Social Security numbers, driver’s license numbers, state identification numbers, financial account numbers, individual taxpayer identification numbers, other government identification numbers, medical records and health histories, health insurance information, and claims and billing information. The specific data types for Marana Health Center patients were not individually specified in the available notice, as the notice uses a template placeholder for that field. No threat actor has publicly claimed responsibility, and the initial access vector has not been disclosed.
Class action plaintiffs allege that Aesto waited 204 days from the start of the breach before notifying victims. Three proposed class action lawsuits were filed against Aesto LLC in U.S. District Court for the Northern District of Alabama between August 31st, 2026, and September 1st, 2026, naming Aesto and co-defendants Everside Health, VillageMD, and Allied Health MSO Holdco. Claims include negligence, breach of implied contract, invasion of privacy, unjust enrichment, and breach of fiduciary duty. No lawsuit specifically naming Marana Health Center was identified. Class action plaintiffs also allege that Aesto experienced a similar breach in 2022 that exposed approximately 17,400 health records, though no prior breaches specific to Marana Health Center were identified in research.
Key Facts at a Glance
- Company or Organization: Marana Health Center, Inc. (d/b/a MHC Healthcare)
- Industry: Healthcare / Federally Qualified Health Center (FQHC)
- Location: Marana, AZ (breach occurred at vendor Aesto Health, headquartered in Birmingham, AL)
- Incident type: Unauthorized access to vendor network (Aesto LLC / Aesto Health)
- Date of breach: December 18th, 2025 (breach activity between December 2nd, 2025, and December 18th, 2025)
- Date breach discovered: May 26th, 2026
- Date of consumer notification: June 26th, 2026
- Prior breach: Aesto alleged to have had a prior breach in 2022 affecting approximately 17,400 records (per class action plaintiffs); no prior breach specific to Marana Health Center identified
- Litigation status: Three proposed class action lawsuits filed against Aesto LLC in U.S. District Court for the Northern District of Alabama on August 31st, 2026, and September 1st, 2026; no suit specifically naming Marana Health Center identified
- Source: California Attorney General breach filing; BleepingComputer; HIPAA Journal; Aesto Health notice; Paubox; Top Class Actions
What Should You Do?
If you received a notice related to this breach, take steps now to protect yourself. Review any Explanation of Benefits statements from your health insurer and check your medical records for unfamiliar entries, since health information was involved. Because Social Security numbers, financial account numbers, and other sensitive identifiers were exposed in the broader Aesto breach, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion. Monitor your credit reports for unfamiliar accounts or activity; you can access free reports at AnnualCreditReport.com. If you suspect your information has already been misused, visit IdentityTheft.gov for step-by-step recovery guidance. If identity theft protection services were offered in your individual notice, enroll before any stated deadline.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
