Lexington Hospital Data Breach Affects 67,000

Lexington Hospital Corp., a healthcare organization based in Lexington, Tennessee, recently disclosed a data breach that affected approximately 67,000 people in the United States.

Lexington Hospital Corp. is connected to several affiliated healthcare entities in the region, according to public provider records. These affiliated entities include Henderson County Community Hospital, Henderson County Medical Group and Lexington Family Physicians RHC.

The breach was reported to the U.S. Department of Health and Human Services on Sept. 8, 2026.

The data security incident was connected to Aesto LLC, a third-party vendor that provided data migration, archiving and historical records management services for Lexington Hospital Corp. The breach did not involve a direct attack on the healthcare organization's own internal systems.

Between on or about Dec. 2 and Dec. 18, 2025, personal and protected health information stored on Aesto's network may have been accessed or acquired by an unauthorized actor.

At this time, the types of PHI or PII compromised for individuals connected to Lexington Hospital remains undisclosed but may have included information such as names, contact information, health records, medical information or other information.

Lexington Hospital's response to the breach

Individuals who have questions about the breach or who want to learn more about the incident should contact the organization directly.