Confirmed breach

Kaniksu Community Health data breach

USUnited States

Kaniksu Community Health (United States) notified the Oregon Department of Justice, the Vermont Attorney General and the California Attorney General of a data breach on 1 September 2026. It told the states about 81,136 Oregon residents; the total can be higher. Exposed: Social Security numbers and Health and medical information. The breach began on 2 December 2025, 273 days before it was reported.

One of 12 organisations whose data was taken through Aesto. The Aesto breach →

Status: Confirmed breach
People affected: 81,136 Oregon residents (one state’s count; the total can be higher)
Reported: 1 September 2026
Across the state notices: at least 81,143 people (Oregon and Vermont: each state counts only its own residents)
Breach began: 2 December 2025
Found to notice: 67 days (found 26 June 2026, by the company’s letter)
Time to tell: 273 days (the median in California’s notices over the last year: 154 days)

What was exposed

Social Security numbers
Health and medical information

How it happened

How: Hacking Aesto had experienced a security event related to its electronic health data management platform source
Through: Aesto, LLC Kaniksu Community Health ("Kaniksu") learned of a data incident involving Aesto, LLC, ("Aesto") a healthcare data management a service provider to Kaniksu source · 12 organisations hit through Aesto →

What the letter says

Found: On or about June 26, 2026, Aesto informed Kaniksu that Aesto had experienced a security event
Began: Aesto advised that the incident occurred on or about December 18, 2025
Exposed: your patient data may have been accessed or acquired due to the unauthorized access to Aesto's platform
At: Kaniksu Community Health ("Kaniksu") learned of a data incident involving Aesto, LLC, ("Aesto") a healthcare data management a service provider to Kaniksu

Got a letter or email about this breach? Check it is real →

Read the letter (PDF), as filed with the California Attorney General.

Sources

Official notices are read by code from the regulator’s own register. More notices to Oregon, Vermont, California. · Corrections and changes

If Kaniksu Community Health had your data

Look for Kaniksu Community Health’s own notice or letter: it should say what of yours was involved. Keep it.
An ID number cannot be changed, so lock it: a credit freeze or fraud alert in the US, a credit warning (kreditadvarsel) on borger.dk in Denmark, Cifas protective registration in the UK.
Check your health insurer’s statements for treatment you never had.
Expect scams that use your details: calls, texts or emails pretending to be Kaniksu Community Health, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

More breaches in United States

Every breach in United States →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.