Mountrail County Medical Center has been identified as a covered entity affected by a security incident at Aesto, a company that provides healthcare data migration and archiving services. A sample notice letter was filed with the Massachusetts state government.
Here is what the filing says, what it leaves out, and what you can do if you received a letter.
Mountrail County Medical Center’s Data Breach Investigation
Mountrail County Medical Center is a health care provider in North Dakota. This page is based on a sample notification letter filed with the Massachusetts state government, which publishes breach notification letters on a public list, together with the vendor’s own public notice naming the medical center as one of the covered entities involved. The incident did not happen on the medical center’s own network. It happened at a vendor, Aesto, LLC, which provides healthcare data migration and archiving services for health care organizations.
According to the filed materials, on or about December 18, 2025, Aesto experienced a network security incident that affected a limited portion of its Amazon Web Services infrastructure. The company says it began an investigation right away and worked with external cybersecurity professionals. After a forensic investigation and a manual review of documents, Aesto says it confirmed on May 26, 2026 that between on or about December 2, 2025, and December 18, 2025, a limited amount of protected health information stored on its network may have been accessed or acquired by an unauthorized actor.
Aesto’s counsel says the company notified the covered entities whose information was involved on June 26, 2026. Aesto states that it has no evidence any of the information has been misused. It also states that the incident was contained to a limited portion of its cloud infrastructure and did not affect the systems of the covered entities themselves. The filing includes an attestation from an outside incident response firm dated January 23, 2026, which says the firm identified how the unauthorized actor got in and found no activity on the network after December 18, 2025.
The attestation lists several remediation steps. These include closing the security gaps the actor used to gain access, deleting affected cloud functions, rotating affected access secrets and deleting unauthorized files the actor uploaded. This page repeats those statements as the company’s own account and has not independently verified them.
The sample letter filed with the state is a mail-merge template. It uses placeholders in place of the recipient’s name, the name of the covered entity, the specific data elements involved and the length and name of any credit monitoring offered. That means the public filing does not tell readers exactly which personal details were involved for any one person. This page does not guess at them. The template does say the information involved includes the recipient’s full name plus other data elements specific to that person, and your own letter is the place to find out which apply to you.
The filing also does not say how many people connected to Mountrail County Medical Center were affected. Aesto serves many health care organizations, and the vendor’s public notice lists a long set of covered entities, so a figure for the vendor as a whole should not be read as a figure for this medical center. This page does not state a count for the medical center because none has been published in the materials reviewed.
The template letter says the covered entity is offering complimentary credit monitoring and that the letter explains how to activate it. It also says the letter contains guidance on placing a fraud alert or security freeze on your credit files, on getting a free credit report, and on protecting your medical information. A dedicated toll-free response line is listed in the letter for questions. If you think you may be involved but did not receive a letter, calling that line, or contacting the medical center directly, is a reasonable first step.
Incidents at vendors that hold health records for many providers can reach people who never dealt with the vendor directly. Patients often learn about them only when a letter arrives from a provider they have seen. Because health records can include identifiers that are hard to change, such as a Social Security number or a medical history, it is sensible to treat any notice seriously, read it carefully and keep it for your records.
Whether or not you received a notice, it is worth reviewing your explanation of benefits statements for services you did not receive, watching your credit reports, and being careful with unexpected calls, texts or emails that mention the incident. Scammers often follow publicized breach notices with messages that ask for personal details. If you are unsure whether a message is genuine, contact the organization using contact details from its own website rather than details in the message.
When Did This Breach Occur?
Aesto reports that the incident occurred between on or about December 2, 2025, and December 18, 2025, and that it confirmed on May 26, 2026 that information may have been accessed or acquired.
Aesto notified the covered entities with involved information on June 26, 2026. The filing does not state the date on which the medical center’s own notice letters were mailed.
What Information Was Breached?
The template notice says the information involved includes the recipient’s full name and other data elements. The filed sample does not list the specific data types.
The company has not published a list of data elements for this medical center. Your own letter should describe the information that applies to you.
What You Can Do
If you received a notice related to Mountrail County Medical Center or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If your letter offers complimentary credit monitoring, follow its instructions to activate it before any deadline it lists.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Mountrail County Medical Center
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the sensitive information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
