Lexington Medical Center, also identified as Lexington Hospital Corporation, experienced a data breach stemming from a third-party vendor, Aesto LLC. The incident involved unauthorized access to data stored on Aesto LLC's network, which provided data migration, archiving, and historical records management services for Lexington Medical Center. The company discovered the breach on July 22, 2026, and reported it to the U.S. Department of Health and Human Services on September 8, 2026. Notices were published to consumers on October 15, 2026.
The breach affected approximately 67,000 individuals in the United States. Potentially compromised data types include first and last names, dates of birth, Social Security numbers, medical record numbers, addresses, government identification numbers, medical information, and financial information. It is not clearly established that every category applied to all affected individuals. The specific financial fields involved remain unclear, and the official notification letter text or a verifiable copy of Lexington Medical Center's public statement were not available in the provided research.
Investigations into this incident are ongoing. The timeline for full disclosure of affected data types, official breach notification letters, and the company's statement regarding the incident are yet to be fully released. Information regarding potential legal actions or specific regulatory filings is also awaiting further public confirmation.