Northern Inyo Healthcare District, doing business as Northern Inyo Hospital, has notified patients that their protected health information may have been exposed following a network security incident at Aesto, LLC, a company that provides healthcare data migration and archiving services to Northern Inyo and other healthcare providers. Aesto stores certain patient records on behalf of the healthcare organizations it serves, and an unauthorized actor may have accessed or obtained a portion of that data.
When patients share their personal and medical information with a hospital, they trust that the hospital and any outside vendors it relies on to store or process that data will keep it secure. Healthcare organizations and the third-party vendors that support them have a responsibility to protect that information from unauthorized access.
Northern Inyo Hospital’s Data Breach Investigation
According to a notification letter sent to affected individuals, Aesto, LLC experienced a network security incident on or about December 18, 2025, that impacted a limited portion of its Amazon Web Services infrastructure. Aesto provides healthcare data migration and archiving services for healthcare providers, including Northern Inyo Healthcare District, and the compromised systems housed protected health information belonging to Northern Inyo Hospital patients.
Upon discovering the incident, Aesto began a prompt investigation and worked with outside cybersecurity professionals experienced in handling this type of intrusion. After an extensive forensic investigation and manual document review, Aesto confirmed on May 26, 2026, that between approximately December 2, 2025, and December 18, 2025, an unauthorized actor may have accessed or acquired a limited amount of protected health information relating to patient care. Aesto notified Northern Inyo Healthcare District of the incident on July 10, 2026, and Northern Inyo subsequently began notifying affected patients.
Third-party vendor breaches have become an increasingly common source of healthcare data exposure, since hospitals and clinics routinely rely on outside companies for services like records archiving, billing, and data migration, each of which requires access to sensitive patient information. A single compromised vendor can therefore affect patients across many different healthcare providers at once. Because the specific categories of information exposed for each patient can vary based on what was stored in the affected systems, individuals should carefully review their own notification letter for the exact details that applied to them.
Depending on what information was involved, patients whose data was exposed in a healthcare vendor breach can face risks ranging from routine identity theft to more targeted medical fraud, in which a stolen identity is used to obtain medical services, prescriptions, or insurance benefits in the victim’s name. Prompt monitoring of financial accounts, credit reports, and medical statements is one of the most effective ways patients can catch and limit the damage from this kind of misuse early.
Aesto has stated it has no evidence that any of the information has been misused, and is offering a complimentary membership in an identity protection service to affected individuals as a precaution.
When Did This Breach Occur?
Aesto, LLC, the data vendor used by Northern Inyo Healthcare District, experienced the network security incident on or about December 18, 2025, with unauthorized access believed to have occurred between approximately December 2, 2025, and December 18, 2025. Aesto confirmed the scope of the incident on May 26, 2026, following a forensic investigation, and notified Northern Inyo Healthcare District on July 10, 2026. Northern Inyo Hospital began sending notification letters to affected patients afterward.
What Information Was Breached?
According to the notification letter, the information potentially involved includes each affected patient’s full name in combination with other personal or protected health information relating to their care that was stored on Aesto’s network. The letter does not specify a single universal list of data elements applicable to every recipient, as the exact information involved may vary by individual; affected patients should refer to their own notification letter for the specific data types that applied to them.
What You Can Do
Aesto, on behalf of Northern Inyo Healthcare District, is offering affected individuals a complimentary membership in Epiq Privacy Solutions Plus, which includes credit monitoring, dark web monitoring, and identity theft insurance. Those who received a notification letter can activate this service using the activation code and instructions provided. In addition to enrolling in the offered service, affected individuals should consider taking the following steps:
- Activate the complimentary identity protection membership described in your notification letter.
- Request a free copy of your credit report from each of the three major credit bureaus and review it for unfamiliar activity.
- Consider placing a fraud alert or a security freeze on your credit file with Equifax, Experian, and TransUnion.
- Monitor your medical bills and insurance statements for services you did not receive.
- Report any signs of identity theft or fraud to local law enforcement and the Federal Trade Commission.
File a Data Breach Lawsuit Against Northern Inyo Hospital
If you received a data breach notification letter regarding this incident involving Northern Inyo Healthcare District or Aesto, LLC, you may have legal options available to help recover damages related to the exposure of your personal and medical information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
