Threat Intelligence Brief
Curated summary with source attribution
Source: claimdepot.com
Threat Risk: High
Victim: Healthcare providers and patients
Incident: Unauthorized access to Aesto Health’s AWS infrastructure resulting in a data breach.
Impact: Exposure of sensitive PII and PHI, including SSNs and medical records, for numerous individuals.
Attacker: Unidentified threat actor
Analysis: An unauthorized actor accessed Aesto Health’s AWS infrastructure in December 2025, leading to the compromise of highly sensitive PII and PHI. The exposed data includes Social Security numbers and detailed medical histories. The significant gap between the incident and final notification emphasizes the challenges of forensic recovery in third-party environments.
Recommendations: Implement strict IAM roles and least-privilege access for all cloud storage environments.; Perform regular security audits and compliance reviews of third-party data processors.; Deploy real-time monitoring and alerting for unauthorized access to sensitive data buckets.
Source: ClaimDepot
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-07 15:29 UTC
A cluster of data breaches affecting healthcare entities and their service providers. Exposure of PII and PHI for millions of individuals, including Social Security numbers and health records. Recent breaches highlight a dangerous trend of targeting the healthcare supply chain, specifically revenue cycle and data migration vendors. The incidents range from cloud infrastructure compromises in AWS to the exploitation of internal employee accounts. These attacks successfully exfiltrated high-value PII and PHI, including Social Security numbers and medical records, across multiple organizations.
Corroborating source: fiercehealthcare.com
Update — 2026-08-14 18:49 UTC
Unauthorized access to AWS infrastructure resulting in a massive data breach of PHI and PII. Exposure of hundreds of thousands of patient records, including Social Security numbers and medical histories. Unauthorized actors accessed Aesto Health’s AWS environment, gaining entry to highly sensitive PII and PHI. The incident demonstrates a significant failure in cloud infrastructure security and identity access controls. The broad impact across multiple healthcare clients underscores the risk of supply chain vulnerabilities in medical data archiving.
Corroborating source: hipaajournal.com
Update — 2026-08-19 01:08 UTC
Unauthorized access to legacy Oracle Health systems resulted in a large-scale data breach. Exposure of highly sensitive medical records and PII, increasing the risk of identity theft for patients. The breach originated from unauthorized access to legacy Cerner systems utilized by Huntsville Hospital. This incident highlights the critical risk associated with maintaining aging infrastructure and the dangers of delayed breach notification. Extensive PII and PHI were compromised, including Social Security numbers and detailed medical histories.
Corroborating source: rocketcitynow.com
Update — 2026-08-20 15:13 UTC
Unauthorized access to an AWS environment resulting in a data breach of 3.7 million patient records. Large-scale exposure of personally identifiable information (PII) and potential regulatory fines. Threat actors gained unauthorized access to one of CareCloud’s AWS electronic health record environments, causing a temporary network disruption. The breach resulted in the theft of personal records for over 3.7 million individuals across the United States. This incident underscores the critical nature of securing cloud-based healthcare infrastructure against unauthorized access.
Corroborating source: techradar.com
Update — 2026-08-21 23:04 UTC
Exposure of sensitive patient data via unencrypted pager transmissions. Unauthorized access to special category health data and potential regulatory penalties from the ICO. The breach occurred because NHS Blood and Transplant utilized unencrypted pager networks to transmit special category patient data. This architectural flaw allowed sensitive medical information to be transmitted in plaintext, potentially accessible to unauthorized eavesdroppers. The incident underscores the persistent risk of relying on legacy hardware that cannot support modern encryption standards.
Corroborating source: tiaa.co.uk