A data breach tied to Lone Star Community Health Center and one of its vendors exposed the personal and protected health information of 250,130 Texas residents, according to a report filed with the Texas Attorney General on August 14, 2026.
The incident centers on Aesto, LLC d/b/a Aesto Health, a Birmingham, Alabama-based third-party vendor that provides healthcare data migration and archiving services. Lone Star Community Health Center, a nonprofit Federally Qualified Health Center based in Conroe, Texas, said the breach was linked to a security incident involving that vendor.
Timeline of the incident
According to the source material, Aesto Health experienced a network security incident affecting a portion of its Amazon Web Services infrastructure on or about December 18, 2025. A forensic investigation later found that an unauthorized actor may have accessed and acquired data between approximately December 2, 2025, and December 18, 2025.
Aesto Health confirmed the scope of the incident on May 26, 2026. It then began notifying affected covered-entity clients, including Lone Star Community Health Center, on June 26, 2026. Lone Star Community Health Center subsequently began notifying affected patients by U.S. Mail.
sbb-itb-535baee
What information may have been exposed
The breach may have compromised a range of sensitive information. According to the source article, the exposed data may include full names, Social Security numbers, dates of birth, driver's license numbers and government-issued identification numbers such as passport or state ID numbers, financial account numbers, medical information, and health insurance information.
The specific combination of data elements varied from person to person.
Who is affected
The 250,130 individuals reported to the Texas Attorney General are all connected to Lone Star Community Health Center. The source article said current and former patients, including people who received a data breach notification letter from Lone Star Community Health Center or Aesto Health, may face an increased risk of identity theft, medical identity theft, insurance fraud, and related harm.
Legal review underway
Edelson Lechtzin LLP said it is investigating data privacy claims arising from the breach and is examining a potential class action on behalf of affected individuals.
The source article also stated: "Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions."
Lone Star Community Health Center is described in the source material as a nonprofit Federally Qualified Health Center based in Conroe, Texas, providing family medicine, pharmacy, dental, and related services to patients across the region.
