G.I. Medicine Associates, P.C., a gastroenterology practice serving the St. Clair Shores and Macomb, Michigan area, notified patients that their personal and health information was compromised as a result of a data security incident at one of its third-party vendors, Aesto, LLC. Healthcare providers and the vendors they rely on to store and manage patient records have a responsibility to protect that sensitive information, and patients deserve to know when it has been compromised.
G.I. Medicine Associates’s Data Breach Investigation
According to a notice filed with the Massachusetts Attorney General’s Office, G.I. Medicine Associates, P.C. (“GIMA”) was informed on June 26, 2026 by Aesto, LLC, a healthcare data migration and archiving vendor, that Aesto had experienced a cyberattack affecting a portion of its Amazon Web Services infrastructure, which stored GIMA’s archived medical records. Aesto’s investigation determined that the unauthorized activity occurred between on or about December 2, 2025 and December 18, 2025. After an extensive forensic investigation and manual document review, Aesto confirmed on May 26, 2026 that protected health information belonging to patients of GIMA and Aesto’s other healthcare provider clients may have been accessed or acquired by an unauthorized party. GIMA received the specific list of affected patients on or about July 15, 2026.
This incident is part of a much larger breach: according to public reporting, the Aesto Health breach affected more than 9.5 million patients across dozens of healthcare provider clients nationwide, making it one of the larger third-party vendor breaches disclosed in 2026. Aesto provides data migration, electronic health record exchange, and legacy data archiving services, meaning a single intrusion at the vendor can ripple out to affect patients of many unrelated healthcare providers who never dealt directly with Aesto themselves.
Third-party vendor breaches like this one are becoming increasingly common in healthcare, where practices routinely outsource records management, data migration, and IT infrastructure to specialized vendors. This creates a broader attack surface: a single vulnerability at one vendor can expose the sensitive data of patients from many unrelated medical practices simultaneously. Because the exposed information includes Social Security numbers, medical record numbers, and dates of birth in combination, affected individuals face an elevated risk of identity theft, medical identity fraud, and targeted phishing attempts that reference their real healthcare provider to appear more convincing.
When Did This Breach Occur?
The unauthorized access at Aesto occurred between approximately December 2, 2025 and December 18, 2025. Aesto detected the incident on or about December 18, 2025, notified GIMA on June 26, 2026, and GIMA received the list of specifically affected patients on or about July 15, 2026.
What Information Was Breached?
The information involved varied by individual but may have included full names in combination with one or more of the following: address, telephone number, date of birth, medical record number, and Social Security number.
What You Can Do
If you are a patient of G.I. Medicine Associates, review any notification letter you receive carefully and consider enrolling in the complimentary identity monitoring services offered. Monitor your credit reports and explanation-of-benefits statements from your health insurer for unfamiliar activity, and consider placing a fraud alert or security freeze with the three major credit bureaus. Be cautious of unsolicited calls or messages referencing this incident, and report any suspected fraud to the FTC or your state attorney general.
File a Data Breach Lawsuit Against G.I. Medicine Associates
If you are a patient of G.I. Medicine Associates and your personal or medical information was exposed in this breach, you may be entitled to compensation. Healthcare providers and their vendors are expected to safeguard patient data, and when that trust is broken, affected patients deserve accountability.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
