Together Women’s Health, a network of women’s healthcare practices, has notified patients that their personal information may have been compromised as a result of a data breach involving one of its third-party vendors. Healthcare providers and the vendors they rely on to manage patient data have a responsibility to protect that information from unauthorized access.
Together Women’s Health’s Data Breach Investigation
Together Women’s Health Medical Group, PC, along with its affiliated Together Women’s Health Medical Group of Alabama, PC, was among more than two dozen healthcare provider clients affected by a security incident at Aesto Health, a Birmingham, Alabama-based company that provides healthcare data migration, legacy data archiving, and electronic health record exchange services. According to Aesto’s public notice, unauthorized activity affecting a limited portion of its Amazon Web Services infrastructure was identified on or about December 18, 2025.
Aesto engaged outside cybersecurity professionals to investigate, and following a forensic review and manual document analysis, the company confirmed on May 26, 2026, that an unauthorized actor may have accessed or acquired certain protected health information stored within its network between December 2 and December 18, 2025. Aesto began notifying its affected covered entity clients, including Together Women’s Health, on or around June 26, 2026.
Healthcare vendor breaches like this one can be especially concerning for patients because the vendor whose systems were actually compromised, in this case Aesto Health, is often a company patients have never directly interacted with or even heard of. A patient may have received care from a Together Women’s Health practice while their records were separately stored, migrated, or archived by Aesto as part of a data management arrangement between the practice and its vendor. This kind of third-party exposure has become increasingly common as more healthcare providers rely on outside vendors for data storage, migration, and record-keeping.
Because medical records, insurance information, government identification numbers, and financial account details may have been combined in the exposed files, affected patients could face a range of risks beyond typical identity theft, including medical identity theft, fraudulent insurance claims, and fraudulent patient billing. Aesto stated it has not found evidence of identity theft or financial fraud connected to the incident as of its notice, though that does not eliminate the possibility of future misuse of the exposed information.
When Did This Breach Occur?
According to Aesto Health’s notice, the unauthorized activity is believed to have occurred between December 2, 2025 and December 18, 2025, with Aesto identifying the incident on or about December 18, 2025. Aesto confirmed on May 26, 2026, following its forensic investigation, that patient information may have been accessed or acquired, and it began notifying affected covered entity clients, including Together Women’s Health, on or around June 26, 2026.
What Information Was Breached?
According to Aesto’s notice, the information potentially involved varied by individual and reportedly included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers, other government identification numbers, and Social Security numbers. Aesto stated that Social Security numbers were potentially involved for a limited number of individuals, and that receiving a notice does not necessarily mean every listed data element was involved for that particular recipient.
What You Can Do
If you received a notice regarding this incident, or believe you may have been a patient of a Together Women’s Health practice during the relevant period, consider taking the following precautions:
- Review any notice you received carefully and keep it with your records
- Check your credit reports for unfamiliar accounts, inquiries, or collection activity
- Consider placing a fraud alert or credit freeze with the major credit bureaus
- Monitor your insurance explanation-of-benefits statements and medical bills for services you did not receive
- Be alert for phishing calls or messages referencing your healthcare provider, insurance, or billing
File a Data Breach Lawsuit Against Together Women’s Health
Healthcare providers and the vendors they rely on to store and manage patient data have a responsibility to protect that information from unauthorized access. If you believe your information may have been compromised in this incident, you may have legal options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
