Johnson Memorial Health System has notified patients that their personal and protected health information may have been exposed in a data security incident that occurred at Aesto, LLC, a third-party vendor the health system used for healthcare data migration and archiving services. Healthcare providers that share sensitive patient data with outside vendors have a responsibility to ensure those vendors protect that information with the same care the provider itself would use.
Johnson Memorial Health System’s Data Breach Investigation
According to the notification letter, Aesto provides healthcare data migration and archiving services for Johnson Memorial Health System and experienced a network security incident that impacted a limited portion of its Amazon Web Services infrastructure on or about December 18, 2025. Aesto commenced a prompt investigation, working closely with external cybersecurity professionals, and after an extensive forensic investigation and manual document review, confirmed on May 26, 2026 that between on or about December 2, 2025 and December 18, 2025, a limited amount of protected health information stored on Aesto’s network, pertaining to Johnson Memorial Health System patients, may have been accessed and acquired by an unauthorized actor.
This incident is part of a much larger breach at Aesto affecting patients across at least 37 different healthcare provider clients nationwide, with Aesto reporting to the U.S. Department of Health and Human Services that the breach affected more than 9.5 million individuals in total, making it one of the largest healthcare data breaches disclosed in 2026. Third-party vendor breaches of this scale illustrate a growing risk in the healthcare industry: a single compromised vendor that provides services like data migration, archiving, or record-keeping to many different providers can expose the sensitive information of patients from dozens of unrelated healthcare organizations in one incident.
Notably, although Aesto discovered the underlying incident in December 2025 and confirmed the scope of the breach by May 26, 2026, affected individuals were reportedly not notified until months later. This gap between discovery and notification is common in large-scale vendor breaches, where the forensic investigation, determination of exactly which individuals and healthcare providers were affected, and coordination among dozens of separately-operated healthcare organizations can take considerably longer than a breach affecting a single company’s own systems.
The healthcare sector remains one of the most frequently targeted industries for data breaches because medical records combine highly sensitive personal, financial, and health information in a single record, information that can be used not only for identity theft and financial fraud but also for medical insurance fraud. When Social Security numbers, financial account numbers, and health insurance information are exposed together, affected individuals face an elevated and prolonged risk of misuse that can be more difficult to detect than a simple stolen credit card number, since fraudulent medical claims and new account openings using this data may not appear on a routine credit card statement review.
When Did This Breach Occur?
Aesto detected unauthorized activity within a portion of its Amazon Web Services infrastructure on or about December 18, 2025. Following an extensive forensic investigation and manual document review, Aesto confirmed on May 26, 2026 that between on or about December 2, 2025 and December 18, 2025, protected health information belonging to Johnson Memorial Health System patients stored on Aesto’s network may have been accessed and/or acquired by an unauthorized actor.
What Information Was Breached?
According to Aesto’s disclosure to the U.S. Department of Health and Human Services covering the full scope of the incident across its affected healthcare provider clients, the information that may have been compromised includes full names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers, other government identification numbers, and Social Security numbers. The specific letter sent to Johnson Memorial Health System patients confirms that at minimum, each affected individual’s full name was involved, along with other data elements specific to that individual.
What You Can Do
Affected individuals should have received instructions from Johnson Memorial Health System and Aesto regarding complimentary credit monitoring services offered in response to this incident. In addition, affected individuals should consider taking the following steps:
- Enroll in any complimentary credit monitoring or identity restoration services offered in your notification letter
- Regularly review financial account statements, credit reports, and health insurance explanation-of-benefits statements for unauthorized activity
- Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion
- Order a free annual credit report at annualcreditreport.com to check for suspicious activity
- Watch for signs of medical identity theft, such as unfamiliar medical bills or insurance claims
File a Data Breach Lawsuit Against Johnson Memorial Health System
If you received a data breach notification letter from Johnson Memorial Health System, you may be entitled to compensation. Healthcare providers that share sensitive patient information with third-party vendors have a legal obligation to ensure that information remains secure.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
