Near North Health has notified the New Hampshire Attorney General and affected patients that their personal information was exposed in a data breach involving Aesto, LLC, a business associate that provides healthcare data migration and archiving services. The notification has left patients concerned about how their sensitive medical and personal information was handled by a vendor working on behalf of their healthcare provider.
Healthcare providers and the vendors they rely on to manage sensitive patient records have a legal and ethical responsibility to protect that information. When a business associate fails to secure the data entrusted to it, the patients whose information is exposed can be left facing real risks to their identity and finances.
Near North Health’s Data Breach Investigation
Near North Health, located in Chicago, Illinois, was notified by its business associate, Aesto LLC, doing business as Aesto Health, that certain data belonging to Near North Health’s patients was involved in a network security incident. Aesto is a healthcare technology company based in Birmingham, Alabama, that provides secure data migration, electronic health record exchange, and legacy data archiving services to healthcare organizations across the country.
According to Aesto’s disclosures, an unauthorized actor accessed and copied data stored on a limited portion of Aesto’s Amazon Web Services network infrastructure between approximately December 2 and December 18, 2025. Aesto conducted an extensive forensic investigation with outside cybersecurity specialists and, on May 26, 2026, confirmed that data belonging to numerous healthcare provider clients had been affected. Aesto notified Near North Health of the incident on July 17, 2026.
Near North Health then reviewed the impacted data and, on September 2, 2026, confirmed that one New Hampshire resident’s information was included among the affected records. Near North Health mailed notification letters to potentially impacted individuals on September 10, 2026. Near North Health is one of at least two dozen healthcare provider clients nationwide known to have been affected by the Aesto incident. Aesto has reported to the U.S. Department of Health and Human Services that the breach, across all of its affected healthcare provider clients combined, involves the protected health information of more than 9.5 million individuals, making it one of the largest healthcare data breaches disclosed in 2026.
Because Aesto served as a shared technology vendor for dozens of separate healthcare organizations, each affected provider, including Near North Health, has had to independently review the data files Aesto supplied and determine its own notification obligations and count of affected patients. This has resulted in a staggered notification process spanning several months, with different healthcare providers notifying their own patients and state regulators at different times throughout the summer and fall of 2026.
Third-party vendor breaches like this one are an increasingly common feature of healthcare data security incidents. Hospitals, clinics, and health centers frequently depend on outside technology companies to migrate, store, or archive electronic health records, and a single vulnerability at one of these vendors can expose the sensitive information of patients across many unrelated healthcare providers simultaneously. Patients typically have no visibility into which outside vendors their healthcare provider uses or how securely those vendors safeguard their data, leaving them dependent on the provider and vendor to maintain adequate protections.
The data types reported in connection with this incident, including Social Security numbers, medical record numbers, and dates of birth, are especially valuable to identity thieves. This information can be used to open fraudulent credit accounts, file false tax returns, or commit medical identity theft, in which a criminal uses a victim’s insurance details to obtain medical treatment or prescriptions in their name. Because medical and identification data does not change the way a password can be reset, the risks tied to this kind of exposure can linger for years.
The multi-month gap between Aesto’s detection of the incident in December 2025 and the eventual notification of affected individuals in the fall of 2026 has drawn attention from patient advocates and legal observers. Prompt notification is a central requirement of most state and federal data breach laws, and lengthy delays can leave affected individuals unaware that they need to take protective action, increasing their exposure to identity theft and fraud in the meantime.
Regulatory attention to vendor-driven healthcare breaches has grown considerably, and state attorneys general have been closely monitoring how Aesto and its many affected healthcare provider clients have responded to this incident. Many state breach notification statutes set specific timelines for reporting once a business determines residents’ personal information has been compromised, and a staggered, multi-provider notification process like this one can make it harder for individual patients to know when, or whether, they need to act. Because Near North Health’s patients learned of the breach through their own provider rather than directly from Aesto, the vendor whose systems were actually compromised, many affected individuals may not fully understand how their information came to be exposed in the first place.
When Did This Breach Occur?
Aesto has stated that the unauthorized access to its network occurred between approximately December 2, 2025, and December 18, 2025. Aesto notified Near North Health of the incident on July 17, 2026. Near North Health confirmed on September 2, 2026, that a New Hampshire resident was among those affected and mailed notification letters to impacted individuals on September 10, 2026.
What Information Was Breached?
According to Near North Health’s notification, the information involved varied by individual but may have included each patient’s name along with one or more of the following: address, Social Security number, medical record number, phone number, email address, and date of birth. Aesto’s broader disclosures regarding the incident across its healthcare provider clients also reference driver’s license numbers, financial account numbers, taxpayer identification numbers, and general health insurance information.
What You Can Do
If you received a notification letter from Near North Health or Aesto regarding this incident, consider taking the following steps:
- Enroll in any complimentary credit monitoring or identity theft protection services offered in your notification letter.
- Place a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
- Request and review a free copy of your credit report at annualcreditreport.com.
- Monitor your financial accounts, insurance statements, and explanation of benefits forms for unfamiliar activity.
- Report any signs of identity theft or medical identity theft to your local law enforcement and state attorney general.
File a Data Breach Lawsuit Against Near North Health
If you were notified that your personal or medical information was compromised in this data breach, you may be entitled to compensation. Healthcare providers and the vendors they rely on to handle sensitive patient data are expected to maintain reasonable safeguards against unauthorized access, and when those safeguards fail, affected individuals can face lasting risks to their identity and finances.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
