Cyber Incident Victim: Lone Star Community Health Center
Timeline
Summary
Lone Star Community Health Center disclosed that a security incident at its third‑party vendor Aesto Health led to the exposure of personal and protected health information for approximately 250,130 patients. The vendor’s Amazon Web Services environment was accessed by an unauthorized actor, who may have acquired data including names, Social Security numbers, birth dates, driver’s license numbers, financial account details, medical records and health insurance information. Aesto Health confirmed the scope of the breach and began notifying its covered‑entity clients, after which the health center mailed notification letters to affected individuals. The exposed data presents risks of identity theft, medical identity theft and insurance fraud.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Lone Star Community Health Center is a nonprofit Federally Qualified Health Center based in Conroe, Texas. The breach was tied to a security incident at Aesto, LLC d/b/a Aesto Health, a Birmingham, Alabama-based third-party vendor that provides healthcare data migration and archiving services. On or about December 18, 2025, Aesto Health experienced a network security incident affecting a portion of its Amazon Web Services infrastructure. A forensic investigation determined that an unauthorized actor may have accessed and acquired data between approximately December 2, 2025, and December 18, 2025. Aesto Health confirmed the scope of the incident on May 26, 2026. Aesto Health began notifying affected covered-entity clients — including Lone Star Community Health Center — on June 26, 2026. Lone Star Community Health Center then began notifying affected patients by U.S. Mail.
According to a report filed with the Texas Attorney General on August 14, 2026, the breach exposed the personal and protected health information of 250,130 Texas residents connected to the health center. The breach may have compromised sensitive personal and health information, including full names, Social Security numbers, dates of birth, driver's license numbers, financial account numbers, medical information, and health insurance information. The specific combination of exposed data elements varied from person to person. Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies on behalf of affected individuals. Healthcare organizations are expected to take reasonable steps to protect patient data.