Aesto Health AWS Infrastructure Breach
Aesto Health suffered a critical compromise of its Amazon Web Services (AWS) environment, resulting in the unauthorized exfiltration of records for approximately 9.5 million patients. The breach likely stemmed from misconfigured Identity and Access Management (IAM) roles or stolen credentials, enabling attackers to access and dump S3 bucket object storage and database snapshots. Exfiltrated data includes Protected Health Information (PHI), Social Security Numbers (SSNs), and financial records. This incident underscores the risk of over-privileged cloud permissions and the necessity of rigorous CloudTrail monitoring to detect anomalous API calls before mass exfiltration occurs.
Aesto Health: AWS Infrastructure Breach and PHI Exposure
In December 2025, Aesto Health suffered a significant data breach resulting from unauthorized access to its Amazon Web Services (AWS) cloud environment. The compromise exposed Protected Health Information (PHI) and Personally Identifiable Information (PII) for approximately 9.54 million individuals. Technical indicators suggest the exploitation of compromised IAM credentials, S3 bucket misconfigurations, or AWS API vulnerabilities, enabling unauthorized API calls and subsequent data exfiltration. Analysis of CloudTrail and VPC Flow Logs indicates a failure to implement the principle of least privilege (PoLP) and gaps in encryption-at-rest effectiveness. The incident triggered mandatory HHS reporting and multiple class-action lawsuits in August 2026 due to systemic HIPAA non-compliance.