FlagThis — Daily Cybersecurity Intelligence Briefing

In December 2025, Aesto Health suffered a significant data breach resulting from unauthorized access to its Amazon Web Services (AWS) cloud environment. The compromise exposed Protected Health Information (PHI) and Personally Identifiable Information (PII) for approximately 9.54 million individuals. Technical indicators suggest the exploitation of compromised IAM credentials, S3 bucket misconfigurations, or AWS API vulnerabilities, enabling unauthorized API calls and subsequent data exfiltration. Analysis of CloudTrail and VPC Flow Logs indicates a failure to implement the principle of least privilege (PoLP) and gaps in encryption-at-rest effectiveness. The incident triggered mandatory HHS reporting and multiple class-action lawsuits in August 2026 due to systemic HIPAA non-compliance.

In May 2026, the threat group ShinyHunters exfiltrated 234 GB of sensitive data from dental benefits administrator DentaQuest. The breach compromised Protected Health Information (PHI) and Personally Identifiable Information (PII), including Social Security numbers and longitudinal clinical records for an estimated 26 million individuals. Initial forensic indicators suggest the attack vector involved either credential stuffing or the exploitation of third-party software vulnerabilities. Following unsuccessful ransom negotiations, the actor published the dataset on a Tor-based leak site. The incident has triggered investigations by the HHS Office for Civil Rights and multiple class-action lawsuits, highlighting the high-value nature of healthcare administration datasets for identity fraud.

McKesson Corporation suffered a significant data breach detected on August 25, 2026, resulting in the alleged exfiltration of 284 million Protected Health Information (PHI) records by the threat actor ShinyHunters. The attack utilized a vishing-based social engineering campaign to obtain administrative credentials for an unnamed third-party application, enabling a supply chain compromise. The incident underscores critical failures in third-party identity and access management (IAM) and highlights the systemic risk of relying on non-phishing-resistant authentication for critical healthcare logistics infrastructure.