HCH patient information involved in data breach

Some Holton Community Hospital patients were notified recently that their personal information was involved in a data security incident involving a third-party vendor.

The incident involved Aesto, LLC, a Birmingham, Ala.-based company that HCH contracts with to store archived and legacy patient data. Aesto recently notified affected patients by mail.

“The incident was confined to Aesto’s Amazon Web Services (AWS) infrastructure and did not involve unauthorized access to HCH’s systems or network,” according to a statement from HCH. “Aesto is a third-party vendor used by HCH to store archived/legacy patient data. Aesto does not serve as HCH’s Electric Medical Records (EMR) vendor, which has not been impacted by this incident.”

According to Aesto officials, the company experienced a network security incident on or about Dec. 18, 2025, that impacted a “limited portion” of its AWS infrastructure.

The incident prompted an investigation, and Aesto officials said the company worked with external cybersecurity professionals. The investigation confirmed that in December 2025, “a limited amount of protected health information pertaining to Holton Community Hospital, which was stored in Aesto’s network, may have been accessed and/or acquired by an unauthorized actor.”

For more on this and other stories, please log in to your holtonrecorder.net account and select “Sept. 30, 2026” under “E-Editions.”