Data Breach & Privacy
Blog > Data Breach & Privacy
Allied Physicians Group Data Breach: Patient Data Copied at Aesto
Letters dated October 8, 2026 say patient information that Allied Physicians Group, a New York physician group focused on pediatrics and adult medicine, stored with vendor Aesto, LLC was copied by an unauthorized actor in December 2025. State filings list Social Security numbers. Here’s what’s known.
What Happened in the Allied Physicians Group Breach
A December 2025 intrusion at data vendor Aesto
In notice letters dated October 8, 2026, Aesto, LLC, which provides healthcare data migration and archiving services for Allied Physicians Group, says it experienced a network security incident on or about December 18, 2025. The incident affected a limited portion of Aesto’s Amazon Web Services infrastructure.
Aesto says it investigated with outside cybersecurity professionals. After a forensic investigation and manual document review, it confirmed on May 26, 2026, that a limited amount of protected health information tied to Allied Physicians Group had been copied from its network by an unauthorized actor between about December 2 and December 18, 2025. Aesto’s public notice says it began alerting its healthcare provider clients on June 26, 2026.
Who Received Allied Physicians Group Letters
Families of a pediatrics-focused New York group
Allied Physicians Group describes itself as more than 150 physicians serving more than 180,000 patients across New York State, with a primary focus on pediatrics and adult medicine. Its practice locations include Brooklyn, Queens, Staten Island, and Nassau, Suffolk, Westchester, Rockland and Orange counties. One line of the Massachusetts letter refers to “your minor’s information,” which suggests some letters are addressed to parents or guardians.
No total has been published for Allied Physicians Group. Massachusetts lists 17 residents, Vermont lists three and the letter counts one Rhode Island resident. The federal HHS breach list shows Aesto, LLC as a business associate that reported 9,540,683 affected people on July 31, 2026, but that figure spans Aesto’s clients and isn’t broken down by provider. Aesto’s online list of affected healthcare clients, last updated October 6, 2026, doesn’t include Allied Physicians Group.
How Allied Physicians Group and Aesto Responded
Cyberscout monitoring and a 90-day sign-up window
The letter says Allied Physicians Group is offering complimentary single-bureau credit monitoring, a credit report and a credit score through Cyberscout. The Massachusetts sample leaves the number of months blank, so check your own letter. Enrollment must happen within 90 days of the letter’s date, about January 6, 2027 for letters dated October 8, and requires an internet connection and an email account. The letter adds that the service may not be available to minors under 18.
Aesto’s public notice says it immediately contained the incident, and the letter says Aesto continually evaluates and modifies its practices and internal controls. The letter also states that notice was not delayed by law enforcement. By the letters’ own dates, notice came nearly 10 months after the intrusion and more than four months after Aesto confirmed health information was involved. HIPAA generally calls for notice without unreasonable delay and no later than 60 days after a breach is discovered; when that period began for Allied Physicians Group hasn’t been made public.
Protecting Your Family After the Allied Breach
Steps for parents and adult patients
Many Allied patients are children, and the monitoring offer may not cover minors, so these steps include protections for kids:
- Freeze your child’s credit. The FTC says parents can request a free credit freeze for a child under 16 by contacting each of the three credit bureaus.
- Enroll in the Cyberscout services if you’re eligible. Use the code in your letter within 90 days of the letter’s date.
- Read your explanation of benefits statements. Look for visits, tests or prescriptions that you or your child never received, as the letter itself recommends.
- Consider a fraud alert. An initial alert is free, lasts one year and requires lenders to take steps to verify your identity before extending credit.
- Treat breach-related calls and emails with caution. Confirm any request through a phone number or website you already trust.
These are general precautions, not legal advice; a legal professional can tell you which ones apply to your family.
Talk to Wilshire Law Firm
Did your family get an Allied Physicians Group letter?
Did an October 2026 letter say your or your child’s information was copied from Aesto’s systems? Wilshire Law Firm is a nationally recognized, award-winning firm that reviews health data privacy claims, and vendor breaches affecting many patients are sometimes pursued as class actions. Talk with a legal professional in a free consultation or free case review at any hour; there are no fees unless you get paid.
Contact Wilshire Law Firm to go over your family’s letter.
FAQs
Aesto says the information was copied between about December 2 and December 18, 2025, and that it experienced the incident on or about December 18. It confirmed health information was involved on May 26, 2026, and the letters are dated October 8, 2026.
The letters describe an incident at Aesto, LLC, the vendor that provides data migration and archiving services for Allied Physicians Group. They don’t describe any intrusion into Allied’s own systems.
Each letter lists the recipient’s name plus the data elements that apply to that person. Vermont and Massachusetts records list Social Security numbers for the residents notified in those states.
Allied’s total hasn’t been published. Massachusetts lists 17 residents, Vermont lists three and the letter mentions one Rhode Island resident. Aesto’s July 31, 2026 report to HHS lists 9,540,683 people, a figure that isn’t broken down by provider.
Yes. The letter offers single-bureau credit monitoring, a credit report and a credit score through Cyberscout, with enrollment due within 90 days of the letter’s date. It notes the service may not be available to minors under 18.
Allied Health MSO Holdco, LLC, which lists a New Jersey address in Texas breach records, filed its own Aesto-related sample notice with California’s Attorney General in August 2026. Those filings don’t say whether it’s connected to Allied Physicians Group, whose listed practice locations are in New York.
You may have options. The letters say health information tied to Allied Physicians Group was copied from a vendor’s network, and state records list Social Security numbers. Vendor breaches like this one are often reviewed as possible class action claims, and a free case review can help you understand where your family stands.
Start Your Free Case Review
- Available 24/7
- Hablamos Español
- Nationally-Recognized Powerhouse Team
As seen in:
We'll contact you within minutes
No fees unless you get paid.
Data Involved in the Allied Physicians Group Breach
Social Security numbers in the state filings
Each letter is filled in with the recipient’s own data elements, so the sample filed in Massachusetts shows only “full name” followed by a blank. State records fill part of that gap. Vermont’s Attorney General lists Social Security numbers for the three Vermont residents notified, and Massachusetts’ 2026 breach report checks Social Security numbers, and none of its other categories, for the 17 Massachusetts residents.
Aesto’s website notice, which covers all of its affected clients, says the data varied by person and could include names, dates of birth, medical and health insurance information, driver’s license and other government ID numbers, financial account numbers, individual taxpayer identification numbers and, for a limited number of people, Social Security numbers. Aesto says it has no evidence that any of the information has been misused.