OB-GYN South, a women’s health practice with locations in the Birmingham, Alabama area and a member of the Together Women’s Health network, has notified patients that their personal information may have been exposed in a data breach. The breach did not occur on OB-GYN South’s own systems, but rather at a third-party vendor the practice relies on to manage patient records, a reminder that healthcare providers’ data security obligations extend to the outside companies they trust with sensitive information.
OB-GYN South’s Data Breach Investigation
According to a notice posted by the vendor, patient information tied to OB-GYN South was compromised in a security incident at Aesto Health, a Birmingham-based healthcare data management and archiving company that provides data exchange services for healthcare organizations. The breach occurred on December 18, 2025, when Aesto’s network was accessed without authorization, with the unauthorized activity reportedly taking place over a period beginning in early December 2025. A forensic review later confirmed that patient data connected to OB-GYN South was among the information exposed. Information reportedly involved in the breach included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and Social Security numbers. Affected individuals were notified by mail after Aesto Health disclosed the incident to its covered-entity clients, including OB-GYN South.
Third-party vendor breaches like this one are an increasingly common way that patient data ends up exposed, since healthcare providers routinely rely on outside companies for services like records archiving, data migration between electronic health record systems, billing, and IT support. When a vendor that serves dozens of healthcare organizations is compromised, the resulting breach can affect patients of many unrelated practices and hospitals at once, even though those patients may have no direct relationship with the vendor itself. This is part of why HIPAA requires healthcare providers to have business associate agreements governing how vendors protect the patient data entrusted to them.
The combination of data types reportedly exposed here is significant. Social Security numbers paired with driver’s license numbers and financial account information gives criminals substantially more material to attempt identity theft or fraudulent account openings than any single data point alone, while medical information exposed alongside identifying details can also be misused for insurance fraud. Patients affected by breaches involving this range of data types are generally encouraged to take a more comprehensive set of protective steps than they might for a breach involving names and addresses alone.
Notification timelines for a vendor-caused breach can also be more complex than a single-company breach, since the vendor must first identify every downstream healthcare organization whose patients were affected before those organizations can, in turn, notify their own patients. This layered process is a normal part of how multi-client vendor breaches unfold, not evidence of unusual delay.
When Did This Breach Occur?
The breach at Aesto Health occurred on December 18, 2025, with unauthorized access reportedly beginning in early December 2025. Affected OB-GYN South patients were notified by mail after the incident was confirmed and disclosed.
What Information Was Breached?
According to the notice, information reportedly exposed included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and Social Security numbers.
What You Can Do
If you received a notification letter connected to this breach, consider the following steps:
- Monitor your credit reports and financial accounts for suspicious activity
- Consider placing a fraud alert or credit freeze with all three major credit bureaus
- Be alert to phishing emails or calls referencing the breach or your medical care
- Change passwords on any potentially affected accounts and enable two-factor authentication where available
- Keep a copy of your data breach notification letter for your records
File a Data Breach Lawsuit Against OB-GYN South
If you are a patient of OB-GYN South and received a data breach notification letter, or believe your information may have been exposed in this incident, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
