Almeida Law Group is investigating a data breach at Nebraska Orthopaedic Center, P.C. The breach occurred on December 2nd, 2025. If you were affected, contact Almeida Law Group.
About Nebraska Orthopaedic Center, P.C.
Nebraska Orthopaedic Center, P.C. is a physician-owned orthopedic practice based in Lincoln, Nebraska, with 62 healthcare providers across 12 locations. It was formed on January 1st, 2022, from the merger of Lincoln Orthopaedic Center, PC and Nebraska Orthopaedic and Sports Medicine, PC. The practice offers services including sports medicine, spine care, joint replacements, fracture care, hand and wrist surgery, foot and ankle care, on-site MRI and imaging, and orthopedic urgent care, with affiliations at Bryan Medical Center, Lincoln Surgical Hospital, and CHI Health St. Elizabeth.
What Happened?
Nebraska Orthopaedic Center, P.C. was listed in a California Attorney General sample breach notice filed in connection with a security incident at Aesto, LLC d/b/a Aesto Health, a healthcare technology company based in Birmingham, Alabama, that provides data migration, legacy data archiving, and EHR exchange services. Aesto was acting as a HIPAA business associate for Nebraska Orthopaedic Center at the time of the breach.
On or about December 18th, 2025, Aesto detected unauthorized activity affecting a limited portion of its Amazon Web Services infrastructure. After a forensic investigation and manual document review, Aesto confirmed on May 26th, 2026, that between approximately December 2nd, 2025, and December 18th, 2025, an unauthorized actor copied data belonging to Nebraska Orthopaedic Center patients that was stored on Aesto’s network. The specific information involved for Nebraska Orthopaedic Center patients includes full names, medical record numbers, dates of birth, and Social Security numbers. Aesto notified its covered entity clients, including Nebraska Orthopaedic Center, on June 26th, 2026. Nebraska Orthopaedic Center sent notice letters to affected consumers on August 18th, 2026 — approximately eight months after the breach began. The breach was contained to Aesto’s AWS infrastructure and did not affect Nebraska Orthopaedic Center’s own systems. No threat actor or ransomware group has publicly claimed responsibility for the attack, and Aesto has not disclosed who was behind it or whether a ransom demand was received, as reported by Teiss.
The Aesto incident affected more than two dozen healthcare provider clients, according to HIPAA Journal. Across all affected clients, the broader incident reportedly involved additional data types beyond what appeared in the Nebraska Orthopaedic Center-specific notice. As of August 12th, 2026, ClassAction.org reports that attorneys — including multiple law firms investigating the broader Aesto Health breach — are evaluating whether a class action lawsuit can be filed on behalf of individuals affected by the Nebraska Orthopaedic Center breach. No filed class action complaint has been reported. Separately, board-cybersecurity.com tracks a prior cybersecurity incident for Aesto first disclosed around May 20th, 2022, with an estimated 10,000 to 100,000 records affected, suggesting this is not Aesto’s first security event.
Key Facts at a Glance
- Company or Organization: Nebraska Orthopaedic Center, P.C.
- Industry: Healthcare / Orthopedic Medicine
- Location: Lincoln, Nebraska (Nebraska Orthopaedic Center); Birmingham, Alabama (Aesto Health, the breached vendor)
- Incident type: Unauthorized access and copying of patient data from a third-party vendor’s cloud infrastructure
- Date of breach: December 2nd, 2025
- Date breach discovered: December 18th, 2025
- Date of consumer notification: August 18th, 2026
- Identity theft protection offered: 12-month single-bureau credit monitoring, credit report, and credit score through Cyberscout/TransUnion
- Prior breach: Aesto Health had a prior cybersecurity incident first disclosed around May 20th, 2022, affecting an estimated 10,000–100,000 records
- Litigation status: Class action investigation underway; no filed complaint reported as of August 12th, 2026
- Source: California Attorney General sample breach notice; Aesto Health official notice; HIPAA Journal; Teiss; ClassAction.org; Board-Cybersecurity.com
What Should You Do?
If you received a notice from Nebraska Orthopaedic Center or Aesto Health, take advantage of the 12-month credit monitoring membership offered through Cyberscout/TransUnion by following the enrollment instructions in your notice letter. Because Social Security numbers and dates of birth were involved, consider placing a fraud alert or security freeze on your credit files with all three major bureaus — Equifax, Experian, and TransUnion. Monitor your credit reports regularly at AnnualCreditReport.com and watch for unfamiliar accounts or inquiries. Because medical record numbers and protected health information were involved, review your Explanation of Benefits statements from your health insurer and request copies of your medical records to check for any services you did not receive. If you detect signs of misuse, report them at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
