Almeida Law Group is investigating a data breach at Together Women’s Health LLC – Aesto. The breach occurred on December 2nd, 2025. If you were affected, contact Almeida Law Group.
About Together Women’s Health LLC – Aesto
Together Women’s Health LLC is a network of gynecologic and obstetric care providers offering a full range of women’s health services, including gynecology, obstetrics, imaging, urogynecology, and ancillary care. Founded in 2020, the company is headquartered in Grosse Pointe, Michigan, and operates clinic locations across Michigan, Illinois, Colorado, Alabama, and Mississippi. The breach did not originate at Together Women’s Health directly but at Aesto LLC (doing business as Aesto Health), a Birmingham, Alabama-based third-party vendor that provides healthcare data migration, legacy data archiving, and electronic health record exchange services for healthcare providers. Because Aesto stored patient records on behalf of Together Women’s Health and its other covered entity clients, a wide range of sensitive health and personal information was potentially involved.
What Happened?
Together Women’s Health LLC – Aesto was listed in a California Attorney General sample breach notice (record ID sb24-628856), reported on August 25th, 2026.
On or about December 18th, 2025, Aesto Health experienced a network security incident affecting a portion of its Amazon Web Services infrastructure. A forensic investigation confirmed on May 26th, 2026 that between December 2nd, 2025 and December 18th, 2025, protected health information stored on Aesto’s network may have been accessed or acquired by an unauthorized actor. No ransomware group or specific threat actor has been publicly attributed to this incident. Aesto notified its covered entity clients, including Together Women’s Health, on June 26th, 2026, and posted a public notice on its website on June 24th, 2026. The breach was reported to the California, Vermont, Washington, and Oregon attorneys general on or around July 31st, 2026. According to Aesto Health’s public notice and attorney general filings, information potentially compromised includes full names, Social Security numbers, drivers’ license numbers, state identification numbers, full or partial dates of birth, health records, medical histories, health insurance policy numbers, claims or billing information, financial account numbers, taxpayer identification numbers, and other government identification numbers. The degree of information affected varied by individual.
Together Women’s Health is one of multiple covered entity clients affected by the Aesto incident; other known affected clients include Everside Health and VillageMD/Village Medical. The gap between the December 2025 incident and the July and August 2026 notifications—roughly eight months—is notable. Multiple law firms have launched class action investigations, including Edelson Lechtzin LLP, which announced its investigation on August 6th, 2026, as well as Pittman Dutton Hellums Bradley & Mann, Markovits Stock & DeMarco, and attorneys at ClassAction.org. No filed class action complaint has been publicly confirmed at this time.
Key Facts at a Glance
- Company or Organization: Together Women’s Health LLC – Aesto
- Industry: Healthcare – Women’s Health (OB/GYN network); breached entity Aesto Health is a healthcare data migration and archiving vendor
- Location: Together Women’s Health LLC is headquartered in Grosse Pointe, MI; Aesto Health (the breached vendor) is based in Birmingham, AL
- Incident type: Unauthorized access to network infrastructure (third-party vendor breach)
- Date of breach: December 2nd, 2025
- Date breach discovered: May 26th, 2026
- Date of consumer notification: June 26th, 2026 (covered entity clients); public notice June 24th, 2026; AG filings on or around July 31st, 2026
- Identity theft protection offered: Yes (IRS Identity Protection PIN guidance referenced in notice letter)
- Litigation status: Multiple class action investigations underway; no filed complaint publicly confirmed
- Source: California Attorney General sample breach notice; Aesto Health official notice; ClassAction.org; HIPAA Journal; Edelson Lechtzin LLP announcement
What Should You Do?
If you received a notice from Together Women’s Health or Aesto Health, take steps now to protect yourself. Enroll in any identity theft protection service offered and note the enrollment deadline in your notice letter. Place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for anyone to open new accounts in your name. Request your free credit reports at AnnualCreditReport.com and review them carefully for accounts or inquiries you do not recognize. Because health and medical information was involved in this breach, review your Explanation of Benefits statements from your insurer and check your medical records for services you did not receive. If you are concerned about tax-related identity theft given that Social Security numbers were exposed, consider obtaining an IRS Identity Protection PIN at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin. Report any signs of fraud or identity theft to IdentityTheft.gov, which can help you create a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
