Health Access Network Data Breach Exposes Social Security Numbers and More

Health Access Network Inc., a nonprofit community health center based in Lincoln, Maine, disclosed a data breach stemming from a December 2025 security incident a vendor that provides healthcare data migration and archiving services for the health center.

On or about Dec. 18, 2025, Aesto, LLC experienced a network security incident that affected a limited portion of its Amazon Web Services infrastructure.

On May 26, 2026, Aesto confirmed that between on or about Dec. 2, 2025, and Dec. 18, 2025, an unauthorized actor may have accessed or acquired protected health information pertaining to Health Access Network patients.

The types of information potentially exposed include full names, Social Security numbers, health records and medical records.

The incident has so far affected 243 Massachusetts residents and 35 Vermont residents.

Health Access Network's response to the breach

Health Access Network is offering affected individuals a complimentary membership to Kroll's identity monitoring services.

Affected individuals can enroll at Kroll's enrollment website using the membership number included in their notification letter. Each letter includes a unique membership number and an activation deadline.

The company has also set up a dedicated toll-free response line for individuals with questions about the incident. The line is staffed with professionals familiar with this incident and is available Monday through Friday, 8 a.m. to 8 p.m. Central Standard Time, excluding major U.S. holidays.