Breaches and incidentsBriefReported by a reputable outlet, citing the company
Aesto, CareCloud and Unlimited Technology Systems: three health IT vendors report 3.75 to 9.5 million each
Reported to HHS OCR in July 2026 (HIPAA Journal): Aesto, LLC 9,540,683 individuals (at least 39 healthcare clients.
- Disclosed
What happened
- Reported to HHS OCR in July 2026 (HIPAA Journal): Aesto, LLC 9,540,683 individuals (at least 39 healthcare clients; unauthorized access to its AWS environment in Dec 2025); Unlimited Technology Systems 3,803,750 (network accessed for five days in Oct 2025); CareCloud 3,756,469 (actor accessed its AWS environment over six days in Mar 2026 and likely exfiltrated databases; CareCloud had earlier told the SEC of an eight-hour EHR outage).
- Root cause: cloud environment compromise (Aesto, CareCloud); specific initial access not disclosed for any of the three.
- Attacker: no group claimed responsibility for any of the three, per HIPAA Journal.
- Response: notifications to client covered entities and individuals ongoing.
Sources
- https://www.hipaajournal.com/july-2026-healthcare-data-breach-report/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-in-august-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.