Healthcare organizations increasingly depend on technology partners to migrate, archive, exchange, and manage sensitive patient information.
That reliance can create significant cybersecurity risk when a third party becomes the point of access to protected health information.
A recent data breach involving Aesto Health highlights this challenge. According to the U.S. Department of Health and Human Services, approximately 9,540,683 individuals are associated with the reported breach involving Aesto, LLC, a healthcare technology and data services provider. HHS categorizes the incident as a hacking or IT incident involving a network server and identifies Aesto as a business associate.
SecurityWeek reports that the incident involved Aesto’s AWS infrastructure and resulted in the theft of personal and health information.
What Happened?
Aesto Health provides healthcare data migration and archiving services for healthcare organizations.
According to Aesto’s incident notification, the company experienced a network security incident affecting a limited portion of its Amazon Web Services infrastructure on or around December 18, 2025.
Aesto’s forensic investigation determined that unauthorized activity occurred between approximately December 2 and December 18, 2025. The company later confirmed that certain protected health information and personal information stored within its environment may have been accessed or acquired by an unauthorized party.
The incident is particularly significant because Aesto’s systems contained information belonging to patients of multiple healthcare organizations.
What Information Was Potentially Exposed?
The information involved varied depending on the individual, but Aesto’s notification lists several highly sensitive categories, including:
• Full names
• Dates of birth
• Social Security numbers
• Driver’s license information
• Other government identification numbers
• Medical information
• Health insurance information
• Financial account information
• Individual taxpayer identification numbers
• Protected health information
Aesto stated that Social Security numbers were potentially involved for a limited number of individuals.
The combination of medical information and identity information makes incidents involving healthcare environments particularly serious.
Why This Breach Matters Beyond Aesto Health
The incident demonstrates that healthcare cybersecurity cannot focus only on hospitals, clinics, and insurance companies.
Modern healthcare ecosystems contain a large network of technology providers, cloud platforms, data processors, electronic health record vendors, archival providers, analytics companies, and other business associates.
A vulnerability or unauthorized access event at one of these organizations can potentially affect information belonging to many healthcare providers and their patients.
This creates a critical security challenge:
Your cybersecurity posture is influenced not only by your own infrastructure, but also by the organizations that process your data.
Third Party Risk Is Becoming a Healthcare Security Priority
Healthcare organizations frequently share sensitive information with external technology providers.
Examples include:
• Cloud service providers
• Data migration companies
• EHR vendors
• Medical billing platforms
• Healthcare analytics providers
• Archiving services
• Patient engagement platforms
• Managed service providers
• Cybersecurity vendors
• AI and automation platforms
Each connection creates another potential attack surface.
Organizations therefore need to understand exactly where sensitive data is stored, who can access it, how it is protected, and what happens if a third party is compromised.
Cloud Security Cannot Be Treated as a Checkbox
The reported incident also highlights the importance of cloud security.
Moving healthcare workloads to cloud infrastructure can provide scalability, flexibility, and operational efficiency. However, organizations still need strong controls around:
• Identity and access management
• Privileged accounts
• Cloud configuration
• Encryption
• Network segmentation
• API security
• Logging and monitoring
• Vulnerability management
• Data classification
• Backup and recovery
• Incident response
A cloud environment can be technically secure while still being exposed through weak identity controls, excessive permissions, compromised credentials, insecure applications, or misconfigured resources.
Healthcare Data Requires Stronger Protection
Unlike many forms of business information, healthcare records can contain information that remains valuable to attackers for years.
Medical records may contain combinations of:
• Identity information
• Health conditions
• Treatment information
• Insurance details
• Government identifiers
• Financial information
Once exposed, this information cannot simply be replaced like a password.
That makes preventive security particularly important.
The Compliance Perspective
Healthcare organizations must also consider regulatory responsibilities when sensitive patient information is involved.
The HIPAA Breach Notification Rule generally requires covered entities and business associates to report breaches involving unsecured protected health information that affect 500 or more individuals. HHS states that its Office for Civil Rights investigates breaches of protected health information affecting 500 or more individuals.
For organizations operating across jurisdictions, additional privacy and data protection requirements may also apply.
A mature compliance program should therefore connect regulatory requirements with practical cybersecurity controls rather than treating compliance as a separate activity.
What Healthcare Organizations Should Do
Organizations that rely on third party healthcare technology providers should consider taking several proactive steps.
1. Conduct Third Party Risk Assessments
Evaluate vendors before granting access to sensitive information and continue reassessing them throughout the relationship.
2. Review Business Associate Agreements
Healthcare organizations should ensure that contractual arrangements clearly establish security, privacy, incident notification, and compliance responsibilities.
3. Apply Least Privilege
Third parties should receive only the access required to perform their assigned functions.
4. Monitor Cloud Environments
Continuous monitoring can help identify unusual authentication activity, privilege changes, suspicious data access, and other indicators of compromise.
5. Protect Sensitive Data
Organizations should implement appropriate encryption, access controls, data classification, retention policies, and monitoring.
6. Test Incident Response Plans
Organizations should know how they will respond if a healthcare technology vendor suffers a breach.
Incident response planning should include communication between:
• Healthcare providers
• Business associates
• Security teams
• Legal teams
• Compliance teams
• Privacy officers
• Executive leadership
AI Adds Another Layer of Risk
Healthcare organizations are also increasingly adopting artificial intelligence for clinical operations, administrative automation, analytics, patient services, and cybersecurity.
AI systems may require access to large volumes of sensitive information.
As organizations introduce AI into healthcare environments, they should evaluate:
• What data AI systems can access
• Where AI data is stored
• Which vendors process the information
• How models are validated
• Whether sensitive information can be exposed through AI interactions
• How access is monitored
• How AI systems are governed
• How security incidents involving AI will be handled
AI governance and healthcare data protection should evolve together.
Industries That Can Learn From This Incident
Although this incident directly affects the healthcare ecosystem, the lessons apply to many industries that depend on third party cloud and data providers.
Healthcare and Life Sciences
COE Security can help healthcare organizations strengthen PHI protection, third party risk management, cloud security, application security, AI governance, and HIPAA aligned security programs.
Financial Services
Financial institutions can benefit from stronger vendor risk assessments, cloud security reviews, identity protection, data security, and continuous threat monitoring.
Retail and E Commerce
Retail organizations can strengthen customer data protection, payment security, API security, cloud environments, and third party integrations.
Manufacturing
Manufacturers increasingly depend on connected technology providers and cloud platforms. Security assessments can help identify weaknesses across enterprise systems, cloud environments, and operational technology.
Government
Government organizations can strengthen third party security, sensitive data protection, identity governance, cloud security, vulnerability management, and incident response.
Conclusion
The Aesto Health breach is a powerful reminder that protecting sensitive healthcare information requires more than securing an organization’s own network.
Third party providers, cloud platforms, business associates, applications, APIs, identities, and data sharing relationships all form part of the modern healthcare attack surface.
With more than 9.5 million individuals listed in the HHS breach record, the incident demonstrates how a security event involving one technology provider can have a much broader impact across the healthcare ecosystem.
Organizations should continuously evaluate their third party relationships, strengthen cloud and identity security, monitor access to sensitive information, test incident response procedures, and integrate cybersecurity with privacy and compliance programs.
Healthcare cybersecurity is no longer only about protecting hospitals. It is about protecting the entire ecosystem that handles patient data.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services
In addition, COE Security helps organizations strengthen healthcare and enterprise cybersecurity through third party risk assessments, vendor security assessments, cloud security assessments, application security testing, API security testing, identity and access reviews, vulnerability management, penetration testing, data protection assessments, AI security assessments, security monitoring, incident response planning, and compliance readiness.
For healthcare organizations, COE Security helps protect sensitive patient information and strengthen security across healthcare applications, cloud infrastructure, business associates, APIs, data migration environments, and AI powered systems.
For financial services organizations, we help protect financial data, customer information, cloud infrastructure, enterprise applications, identities, and third party integrations.
For retail and e commerce organizations, we help secure customer information, payment environments, APIs, cloud applications, and technology partners.
For manufacturing organizations, we help identify cybersecurity weaknesses across enterprise systems, cloud infrastructure, connected environments, and operational technology.
For government organizations, we help strengthen data protection, identity security, third party risk management, cloud security, vulnerability management, and incident response capabilities.
As organizations increasingly rely on cloud platforms, AI systems, and technology partners, COE Security helps businesses identify security gaps, reduce attack surfaces, protect sensitive information, and build cybersecurity programs aligned with business and compliance requirements.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption and to stay updated and cyber safe.
Click to read our LinkedIn feature article