My Doctor, LLC has notified individuals that some of their protected health information may have been affected by a security incident at one of its vendors. Complimentary identity monitoring is being offered to those affected. Companies that rely on outside vendors to store or process sensitive health data still bear a responsibility to ensure that information is properly protected.
My Doctor, LLC’s Data Breach Investigation
According to a notification letter sent on behalf of My Doctor, LLC, the incident actually originated at Aesto LLC, a company that provides healthcare data migration and archiving services to My Doctor, LLC and other covered entities. On or about December 18, 2025, Aesto experienced a network security incident affecting a limited portion of its Amazon Web Services infrastructure. Aesto’s investigation, conducted with outside cybersecurity professionals, determined that between approximately December 2, 2025 and December 18, 2025, a limited amount of sensitive information stored on Aesto’s network, including data pertaining to My Doctor, LLC’s patients, may have been accessed or acquired by an unauthorized party. Aesto confirmed these findings on May 26, 2026 and notified affected covered entities, including My Doctor, LLC, on June 26, 2026.
Vendor-related breaches like this one are an increasingly common way for patient data to be exposed, since a single third-party processor can hold records on behalf of many different healthcare providers at once. A successful intrusion into one vendor’s systems can therefore expose sensitive information belonging to patients of numerous unrelated practices, even when the practices themselves have no direct security failure of their own. This is one of the reasons healthcare data breaches have become so frequent and can be difficult for an individual patient to trace back to its ultimate source.
Protected health information, even when limited to a name paired with other health-related or identifying details, can be misused for medical identity theft, insurance fraud, or targeted phishing schemes that reference a person’s actual medical provider to appear more convincing. Because health records are not easily replaced the way a compromised credit card number can be, exposed medical data can remain a source of risk for years after an incident like this one.
When Did This Breach Occur?
The underlying incident at Aesto LLC occurred between approximately December 2, 2025 and December 18, 2025. Aesto confirmed that patient information had been affected on May 26, 2026, and notified My Doctor, LLC and other affected covered entities on June 26, 2026.
What Information Was Breached?
The notification letter indicates that each affected individual’s full name was involved in combination with certain other personal or protected health information specific to that individual. My Doctor, LLC and Aesto have not published a single universal list of data elements affecting every recipient, since the specific information involved can vary by individual.
What You Can Do
If you received a notification letter regarding this incident, consider taking the following steps:
- Enroll in the complimentary Experian IdentityWorks membership referenced in your notification letter before the enrollment deadline.
- Review your medical and insurance statements for any services or claims you don’t recognize.
- Monitor your credit reports and consider placing a fraud alert or security freeze.
- Be cautious of any calls, texts, or emails referencing this incident that ask for personal information.
File a Data Breach Lawsuit Against My Doctor, LLC
If you were notified that your personal or health information may have been affected by this incident, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
