Privacy Unpacked- Status
- Confirmed breach
- People affected
- Not reported yet
- Reported
- 25 August 2026
- Breach began
- 2 December 2025
- Found to notice
- 91 days (found 26 May 2026, by the company’s letter)
- Time to tell
- 266 days (the median in California’s notices over the last year: 154 days)
What was exposed
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.
How it happened
- How
- Hacking
On or about December 18, 2025, Aesto experienced a network security incident that impacted a limited portion of their Amazon Web Services infrastructure
source - Through
- Aesto, LLC
Aesto, LLC ("Aesto") provides healthcare data migration and archiving services for SpineZone and writes with important information regarding a recent data security incident at Aesto involving some of your protected health information that was being maintained by Aesto
source · 12 organisations hit through Aesto →
What the letter says
- Found
on May 26, 2026, Aesto confirmed that between on or about December 2, 2025, and December 18, 2025, a limited amount of your protected health information, which was stored within Aesto's network, may have been accessed and/or acquired by an unauthorized actor
- Began
between on or about December 2, 2025, and December 18, 2025, a limited amount of your protected health information, which was stored within Aesto's network, may have been accessed and/or acquired by an unauthorized actor
- People
There are approximately 2 Rhode Island residents affiliated with SpineZone that may be impacted by this event
- Exposed
The information potentially impacted includes your full name
- At
Aesto, LLC ("Aesto") provides healthcare data migration and archiving services for SpineZone and writes with important information regarding a recent data security incident at Aesto involving some of your protected health information that was being maintained by Aesto
- Offered
you are being offered a complimentary twelve (12) month membership of credit monitoring and identity theft protection services from TransUnion
Got a letter or email about this breach? Check it is real →
Read the letter (PDF), as filed with the California Attorney General.
Sources
Official notices are read by code from the regulator’s own register. More notices to California. · Corrections and changes