Edwards County Medical Center, a critical access hospital in Kinsley, Kansas, has notified patients that a data security incident at Aesto, LLC, a business associate that provides healthcare data migration and archiving services, may have exposed their personal and protected health information. Healthcare providers and the vendors they trust with patient records have a responsibility to safeguard that sensitive information from unauthorized access.
Edwards County Medical Center’s Data Breach Investigation
Edwards County Medical Center relies on Aesto, LLC (also known as Aesto Health), a Birmingham, Alabama-based healthcare technology company, to provide secure data migration, legacy data archiving, and electronic health record exchange services. According to a notice Aesto sent on behalf of Edwards County Medical Center, Aesto experienced a network security incident that impacted a limited portion of its Amazon Web Services (AWS) infrastructure. Aesto has stated that upon learning of the issue, it commenced a prompt and thorough investigation and worked closely with outside cybersecurity professionals who specialize in incidents of this kind.
After an extensive forensic investigation and a manual review of the affected files, Aesto confirmed on May 26, 2026 that an unauthorized actor may have accessed or acquired a limited amount of sensitive information belonging to patients of Edwards County Medical Center and other healthcare providers that rely on Aesto’s services. The investigation determined that the unauthorized access occurred between on or about December 2, 2025 and December 18, 2025. Aesto notified Edwards County Medical Center, as the HIPAA covered entity responsible for the affected records, of the incident on June 26, 2026. Edwards County Medical Center then began notifying affected patients directly, with letters going out on or around August 26, 2026, roughly eight months after the intrusion was first detected.
Public reporting indicates that Edwards County Medical Center is only one of more than two dozen healthcare provider clients affected by the Aesto security incident, a group that reportedly includes hospitals, clinics, and health systems across multiple states, including Kansas, Texas, Washington, South Carolina, Oregon, and Vermont. Because Aesto serves as a data processor and archiving vendor for so many covered entities, the true scope of the breach has been difficult for outside observers to pin down precisely. Industry reporting has estimated the incident has affected hundreds of thousands of patients across all of Aesto’s affected clients combined, with some individual providers reporting tens of thousands of impacted patients apiece, while other, smaller providers like Edwards County Medical Center may have had only a small number of patient records involved.
When a healthcare provider works with an outside vendor to migrate or archive electronic health records, that provider is depending on the vendor to maintain security controls at least as strong as its own. According to Aesto, the affected data in this case had been stored within its AWS environment as part of the archiving and migration services it performs for its healthcare clients. The forensic review that followed the discovery of the incident took several months to complete, a timeline that is not unusual for incidents involving large volumes of archived records spanning multiple client organizations, but one that nonetheless left affected patients unaware that their information may have been compromised for a significant stretch of time.
Aesto has stated that it has no evidence that any of the compromised information has actually been misused for identity theft or fraud, but it and Edwards County Medical Center are offering complimentary single-bureau credit monitoring and identity theft protection services to affected individuals as a precaution. Both organizations say they have taken additional measures since the incident to strengthen the security of the systems and networks involved and to help prevent a similar event from happening again in the future.
When a healthcare provider entrusts a vendor with patients’ Social Security numbers, medical records, and other protected health information, that provider does not get to simply point to the vendor and walk away from responsibility. Under HIPAA and various state consumer protection laws, covered entities like Edwards County Medical Center remain accountable for ensuring that any business associate handling patient data has adequate safeguards in place. Attorneys are now investigating whether Edwards County Medical Center and Aesto took reasonable steps to prevent this kind of unauthorized access, and whether the roughly eight-month gap between the initial December 2025 intrusion and the notification letters mailed in August 2026 was consistent with applicable breach notification laws.
When Did This Breach Occur?
According to Aesto’s notice, the unauthorized access to its Amazon Web Services infrastructure occurred between on or about December 2, 2025 and December 18, 2025, when Aesto detected the network security incident. Aesto states that after an extensive forensic investigation and manual document review, it confirmed on May 26, 2026 that a limited amount of sensitive information belonging to Edwards County Medical Center’s patients had been accessed or acquired without authorization during that window. Aesto notified Edwards County Medical Center of the incident on June 26, 2026, and Edwards County Medical Center began sending notification letters to affected patients on or around August 26, 2026.
What Information Was Breached?
Edwards County Medical Center’s notice states that the information potentially exposed includes patients’ full names, dates of birth, Individual Taxpayer Identification Numbers, and medical information such as hospital unit and treating physician name, as well as medical record numbers. Because the underlying incident affected Aesto’s broader infrastructure, other individuals connected to Aesto’s healthcare provider clients have reported that additional data types, including Social Security numbers, driver’s license numbers, financial account numbers, and health insurance information, may also have been compromised depending on the specific records a given provider had stored with Aesto.
What You Can Do
Edwards County Medical Center and Aesto are offering affected individuals a complimentary 24-month membership in single-bureau credit monitoring and identity theft protection services through Equifax. To enroll, eligible individuals can visit Equifax’s activation website and provide the activation code included in their notification letter. Beyond enrolling in monitoring, affected patients should regularly review their financial account statements, medical bills, and insurance explanation-of-benefits statements for any charges or services they do not recognize. Placing a fraud alert or security freeze with the three major credit bureaus, Equifax, Experian, and TransUnion, adds an extra layer of protection against someone opening new credit in your name. If you notice any suspicious activity, report it promptly to your financial institution, local law enforcement, and your state Attorney General’s office.
File a Data Breach Lawsuit Against Edwards County Medical Center
If you received a notice that your information was involved in the Edwards County Medical Center data breach, you may have legal options. A class action lawsuit could hold Edwards County Medical Center and Aesto accountable for failing to adequately protect the sensitive patient information entrusted to them, and could result in compensation for those affected.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
