Catalyst Physician Group Data Breach

Catalyst Physician Group has notified patients that a data security incident at Aesto, LLC, a business associate that provides healthcare data migration and archiving services, may have exposed their personal and protected health information. Healthcare providers that rely on outside vendors to manage patient records have a responsibility to ensure those vendors safeguard that information just as carefully as the provider itself would.

Catalyst Physician Group’s Data Breach Investigation

According to a notice sent on behalf of Catalyst Physician Group, Aesto, LLC experienced a network security incident that impacted a limited portion of its Amazon Web Services infrastructure on or about December 18, 2025. Following an extensive forensic investigation and manual document review, Aesto confirmed on May 26, 2026 that between on or about December 2 and December 18, 2025, a limited amount of protected health information pertaining to Catalyst Physician Group patients, which was stored within Aesto’s network, may have been accessed and/or acquired by an unauthorized actor. Aesto has stated it has no evidence that any of the information has been misused.

Aesto provides secure data migration, electronic health record exchange, and legacy data archiving services to healthcare providers and medical practices across the country, and public reporting indicates the same incident affected numerous other healthcare provider clients beyond Catalyst Physician Group. Incidents involving third-party vendors that aggregate patient records from many different healthcare providers are an increasingly common target for cybercriminals, since a single successful intrusion can expose sensitive information belonging to patients of many unrelated practices at once. The combination of medical records with identifying information like full names is valuable to criminals because it can enable both traditional identity theft and medical identity theft, where a person’s health insurance information is used fraudulently.

Notably, the gap between when the incident was first detected in December 2025 and when Aesto completed its investigation and began notifying covered entities in mid-2026 reflects the often lengthy forensic review process required to determine exactly whose information was involved in a large-scale vendor breach. Catalyst Physician Group, along with dozens of other healthcare providers affected by the same Aesto incident, began sending notification letters to patients only after Aesto completed that review and provided the covered entities with the results.

When Did This Breach Occur?

Aesto identified the network security incident affecting its AWS infrastructure on or about December 18, 2025. The company’s subsequent investigation determined that unauthorized access to files containing Catalyst Physician Group patient information may have occurred between on or about December 2, 2025, and December 18, 2025. Aesto completed its review and notified Catalyst Physician Group of the results on May 26, 2026.

What Information Was Breached?

According to the notice, the information potentially impacted includes each affected patient’s full name, along with additional personal information that varies by individual and is detailed in that person’s specific mailed notification letter.

What You Can Do

If you received a notice from Catalyst Physician Group or Aesto regarding this incident, consider taking the following steps:

• Enroll in the complimentary identity theft protection services offered through IDX before the stated deadline.
• Monitor your financial accounts and credit reports for unfamiliar activity.
• Consider placing a fraud alert or credit freeze with the major credit bureaus.
• Review your medical records and explanation of benefits statements for unfamiliar treatments or charges.
• Request a free copy of your credit report at annualcreditreport.com to check for suspicious activity.

File a Data Breach Lawsuit Against Catalyst Physician Group

If you received a data breach notification from Catalyst Physician Group or believe your personal or health information may have been compromised in the Aesto incident, you may be entitled to compensation. Healthcare providers and the vendors they trust with patient records have a responsibility to safeguard that information from unauthorized access.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.