Almeida Law Group is investigating a data breach at Northern Inyo Healthcare District d/b/a Northern Inyo Hospital. The breach occurred on December 2nd, 2025. If you were affected, contact Almeida Law Group.
About Northern Inyo Healthcare District d/b/a Northern Inyo Hospital
Northern Inyo Healthcare District d/b/a Northern Inyo Hospital is a 25-bed critical access not-for-profit district hospital located in Bishop, California, in the Eastern Sierra. Operating since 1946 and accredited by The Joint Commission, it provides 24-hour emergency care, primary care, diagnostic imaging, rehabilitation, and specialty outpatient clinics. Importantly, this breach did not originate from Northern Inyo Hospital’s own systems. Instead, it stems from a security incident at Aesto, LLC d/b/a Aesto Health, a Birmingham, Alabama-based healthcare technology company that provides data migration, legacy data archiving, and electronic health record exchange services to healthcare providers including Northern Inyo Hospital.
What Happened?
Northern Inyo Healthcare District d/b/a Northern Inyo Hospital was listed in a California Attorney General sample breach notice. The incident is a third-party vendor breach: on or about December 18th, 2025, Aesto Health detected a network security incident affecting a portion of its Amazon Web Services infrastructure. A forensic investigation confirmed on May 26th, 2026, that unauthorized access had occurred between approximately December 2nd, 2025 and December 18th, 2025, during which a limited amount of protected health information stored on Aesto’s network may have been accessed or acquired by an unauthorized actor. Aesto posted a public notice on its website on June 24th, 2026, and began notifying affected healthcare provider clients starting June 26th, 2026. Aesto notified Northern Inyo Hospital specifically on July 10th, 2026. The breach was reported to the California, Vermont, and Washington attorneys general on July 31st, 2026.
According to Aesto Health’s public notice and attorney general filings, the categories of information potentially compromised across affected clients include full names, Social Security numbers, dates of birth, driver’s license numbers, state identification numbers, financial account numbers, taxpayer identification numbers, health records, medical histories, health insurance policy numbers, and claims and billing information. The specific data elements exposed for Northern Inyo Hospital patients were not publicly specified in the notice, as the individual notification letter contains template placeholders for those fields. Northern Inyo Hospital is one of more than two dozen healthcare provider clients affected by the Aesto breach. Aesto has stated it has no evidence that any protected health information has been misused as a result of this incident. No ransomware group or specific threat actor has been publicly identified in connection with the incident.
Multiple law firms have publicly announced investigations and are soliciting affected individuals, including Edelson Lechtzin LLP, Levi & Korsinsky LLP, Potter Handy LLP, Markovits Stock & DeMarco LLC, and Federman & Sherwood. ClassAction.org has reported that attorneys have completed their initial investigation into the matter, though no filed class action complaint has been confirmed in public records.
Key Facts at a Glance
- Company or Organization: Northern Inyo Healthcare District d/b/a Northern Inyo Hospital
- Industry: Healthcare (critical access hospital / healthcare district) — breached via third-party healthcare data archiving vendor
- Location: 150 Pioneer Lane, Bishop, CA 93514
- Incident type: Unauthorized access to third-party vendor’s network (Aesto Health)
- Date of breach: December 2nd, 2025
- Date breach discovered: December 18th, 2025
- Date of consumer notification: August 20th, 2026
- Identity theft protection offered: Complimentary Epiq Privacy Solutions Plus membership
- Prior breach: None identified
- Litigation status: No filed class action confirmed; multiple law firm investigations publicly announced
- Source: California Attorney General sample breach notice; HIPAA Journal; Aesto Health official notice
What Should You Do?
If you received a notice about this breach, you should enroll in the complimentary Epiq Privacy Solutions Plus identity protection membership offered through the notice as soon as possible and before any enrollment deadline stated in your letter. You can also place a fraud alert or credit freeze on your credit files with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Regularly monitor your financial account statements and credit reports for unfamiliar or suspicious activity, and request your free annual credit reports at AnnualCreditReport.com. If you believe your information has already been misused, visit IdentityTheft.gov for step-by-step guidance. Because health information was involved in this incident, you should also review your Explanation of Benefits statements from your health insurer and check your medical records for any services you do not recognize, which could indicate fraudulent use of your health information.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
