The breach originated within the Amazon Web Services infrastructure of Aesto Health, an Alabama-based firm specializing in data migration and archiving. Forensic analysis indicates that unauthorized actors gained access to sensitive records between December 2 and December 18, 2025. While the incident was identified by the vendor in May 2026, notification to affected patients at the Conroe-based nonprofit began only after the scope was confirmed.

Compromised files include Social Security numbers, driver's licenses, financial account details, and comprehensive health insurance information. Patients are now being urged to monitor their credit reports and place security freezes on their accounts to mitigate the risk of identity theft and insurance fraud. Edelson Lechtzin LLP is currently evaluating legal remedies for those impacted, asserting that healthcare providers and their vendors bear a fundamental responsibility to maintain robust protections for patient data.