Third-party vendor breaches now drive 43% of health data incidents

What the Aesto Health breach reveals about orphaned data

Aesto Health, a Birmingham, Alabama vendor that handles data migration and legacy EHR archiving, confirmed a breach affecting 9,540,683 patients across at least 36 provider clients, including VillageMD, Everside and Marathon Health, and Marana Health. It is the second-largest confirmed U.S. healthcare breach of 2026. The intrusion was detected on Dec. 18, 2025 in AWS infrastructure, but the incident only appeared on the HHS portal roughly eight months later.

Every element of that timeline should worry a board. The company sits in a category most directors have never heard of. Its business model is holding decades of records from decommissioned systems and acquired practices, which means the data volume per client is disproportionate to the contract value. The compromise occurred in a cloud tenant the health systems did not control or instrument. And the notification arrived long after the window in which affected patients could have acted.

This is the orphaned data problem. After a merger or a platform replacement, the old records still have to live somewhere, and custody quietly migrates to whoever won the archiving bid. Nobody in clinical operations touches that data again. Nobody in security scans it. Nobody in legal revisits the contract. It becomes a permanent liability with no internal owner.

A risk register that grows faster than it closes is not a control. It is a discovery document waiting for a plaintiff's attorney.

The numbers behind the business associate shift

As of July 10, 2026, HHS listed 351 large breaches for the year affecting nearly 20.7 million people. Business associates were tied to 145 of them and to roughly half of all victims, according to GovInfoSecurity's reading of the portal. The concentration effect is the story: a single vendor compromise now routinely produces more affected individuals than dozens of direct hospital intrusions combined.

The exposure is not limited to archiving vendors. Craneware, whose revenue cycle and pricing products serve more than 2,000 U.S. hospitals and roughly 10,000 pharmacies and clinics, disclosed in July 2026 that attackers stole what it described as a significant volume of data. Vendors that touch charge capture, claims, imaging and patient communications all aggregate data across hundreds of provider clients by design. That aggregation is the product. It is also the blast radius.

Visibility improved. Remediation collapsed.

Fortified Health Security's 2026 Mid-Year Horizon Report found that providers identified six times more cybersecurity supply-chain risks in H1 2026 than in the same period of 2025, with 63% of those risks rated critical or high. That looks like progress until you read the next line. Organizations remediated only 6.4% of identified risks in H1 2026, down from 23.3% a year earlier.

In other words, the assessment machinery is working and the fixing machinery is not. Health systems have bought the questionnaires, the vendor risk platforms and the scoring tools. What they have not built is the operational capacity to act on findings, or the contractual leverage to make a vendor remediate on a deadline. A risk register that grows faster than it closes is not a control. It is a discovery document waiting for a plaintiff's attorney.

The HIPAA Security Rule delay removes the regulatory floor

Clark Hill and Clearwater both confirmed in July 2026 that HHS moved the HIPAA Security Rule overhaul to its Long-Term Actions agenda, with final action now targeted for July 2027. That proposed rule would have made vendor security assessment and continuous monitoring an explicit, documented requirement rather than a matter of judgment. OCR is proceeding separately on Privacy Rule changes.

The practical effect is that no compliance deadline is arriving to force the work. Leaders who were waiting for the rule to unlock budget and organizational attention have lost that lever for at least a year. The alternative is to do it voluntarily, through the only mechanism that still binds a vendor: the contract.

What healthcare leaders should renegotiate first

Start with breach notification clocks. Business associate agreements that allow 60 days from discovery are how an eight-month disclosure lag becomes technically compliant. Push for notice within 72 hours of detection of a suspected incident, with a duty to provide client-specific data scoping within 30 days.

Then demand proof of deletion. For archiving and migration vendors, require certified destruction on a defined schedule, plus an annual attestation listing exactly which of your data sets the vendor still holds and in which cloud tenant. Most health systems cannot currently produce that inventory for their own third parties. Building it is the single highest-yield exercise available before the next disclosure lands.

Finally, tie money to remediation. Contract terms should include evidence rights for cloud configuration and access logging, service-level commitments on patching critical findings, and financial consequences for missed deadlines. Assign an internal owner for post-M&A record custody so archived data does not fall out of the risk program the moment the integration project closes.