Lexington Hospital Data Breach: Vendor Alerted the Hospital Seven Months Later

In a notice posted September 1, 2026, Lexington Hospital Corporation says the incident happened at Aesto, LLC, a company that handled data migration and archiving and kept certain historical records on the hospital’s behalf. According to the notice, Aesto had a network security incident on or about December 18, 2025, that reached a limited portion of its Amazon Web Services setup, while its core data platform was not compromised.

Aesto’s investigation confirmed on May 26, 2026, that information may have been accessed or acquired by an unauthorized actor between about December 2 and December 18, 2025. The hospital says it didn’t hear about the incident from Aesto until July 22, 2026, about seven months after the intrusion ended.

The hospital lists first and last names and dates of birth, and, for some people, Social Security numbers and medical record numbers. Not every item applied to every person, and each mailed letter names the categories that applied to its recipient.

Aesto’s own public notice, written for all of its healthcare clients, describes a wider range of possible data, such as driver’s license numbers, financial account numbers and health insurance information. Lexington Hospital’s notice doesn’t list those categories for its records. The hospital says there is no evidence so far that any of the information has been misused.

The notice says the files are historical records that predate Lexington Hospital Corporation’s 2020 acquisition of the facility, so the people being notified are those whose records come from before that year. The notice also includes separate enrollment steps for parents and guardians signing up a minor.

The hospital hasn’t published how many people it is notifying. It says it reported the incident to the U.S. Department of Health and Human Services, but as of October 15, 2026, no Lexington Hospital entry appears on the federal breach list. That list does show a July 31, 2026 report from Aesto, LLC covering 9,540,683 people, which BleepingComputer has linked to this incident and which includes patients of many other providers.

Lexington Hospital says it reviewed what Aesto found, reported the incident to federal regulators and is mailing letters to the people involved. Aesto, according to the notice, secured the affected systems, reset credentials, strengthened its monitoring and saw no further unauthorized activity. The hospital also says the incident did not involve ransomware and never touched its live clinical systems or current patient records.

The hospital is offering a free Experian IdentityWorks membership for identity protection. Every letter includes the activation code and engagement number needed to enroll, sign-ups close December 31, 2026, and the codes stop working after that. The notice doesn’t say how long the membership lasts, and it went up 41 days after Aesto told the hospital and more than eight months after the intrusion.

Because these records are years old, you may have moved or changed insurers since your visit. These steps match what the notice lists:

• Enroll before December 31. Use the code from your letter; the hospital says no credit card is required.
• Freeze your credit. A freeze is free, restricts access to your credit report until you lift it, and must be requested at each of the three bureaus.
• Add a fraud alert if you prefer. A one-year alert is free, and placing it with one bureau extends it to the other two.
• Read your insurer’s explanation of benefits statements. Medical record numbers may be involved for some patients, so look for care you never received.
• Hang up on anyone asking for your full Social Security or bank account number. The hospital says it will never request either by phone, so verify any outreach independently before responding.

Treat this list as general information rather than legal advice; a legal professional can help you weigh which steps make sense for you.

Did your Lexington Hospital letter say your Social Security number or medical record number was in the files Aesto kept? Wilshire Law Firm is a nationally recognized, award-winning firm whose team reviews data privacy and vendor breach claims, and incidents reaching patients of many providers are often brought as class actions. Our free case reviews and free consultations with a legal professional run 24/7, and Wilshire Law Firm charges no fees unless you get paid.

Contact Wilshire Law Firm to talk through your letter.