GI Medicine Associates data breach: 264,724 patients, through the Aesto records archive

Why did GI Medicine Associates patients get a breach letter?

Because their old records sat in Aesto's archive. GIMA's notice says Aesto provides healthcare data migration and archiving services for its covered entity clients, including GIMA. The breach was in Aesto's systems, not GIMA's.

The Aesto entry covers the vendor's side: the AWS incident, the 9,540,683 people in the federal health record and the other hospitals and clinics whose patients were reached. The guide to letters from companies you never dealt with explains vendor breaches like this one.

What happened, and when?

Date	What happened	Source
On or about December 2 to 18, 2025	Patient information at Aesto may have been accessed or taken; Indiana's breach date is December 2	GIMA notice; Indiana record
On or about December 18, 2025	Aesto's incident, as GIMA describes it	GIMA notice
May 26, 2026	Aesto's forensic experts confirm the window	GIMA notice
June 26, 2026	Aesto tells GIMA	GIMA notice
On or about July 15, 2026	GIMA receives the list of affected patients	GIMA notice
August 17, 2026	GIMA posts its website notice	GIMA notice
September 8, 2026	Notice to Indiana residents	Indiana record

GIMA learned of the incident more than six months after it happened. From the day Aesto told it to its website notice took 52 days; the patient list arrived 19 days in.

What information was involved in the GI Medicine Associates breach?

The two GIMA documents give different lists, and the website notice's is longer. The letter filed in Massachusetts lists full names with one or more of address, telephone number, date of birth, medical record number and Social Security number. The website notice, written for everyone in the files, adds medical information, driver's license numbers, financial account numbers, health insurance information, individual taxpayer identification numbers and other government ID numbers. The items vary by person, so each letter is the place to check your own.

GIMA says Aesto has told it there is no evidence of identity theft or financial fraud from the incident.

How many people were affected by the GI Medicine Associates breach?

264,724 people, the total GIMA reported to Indiana; 77 live in Indiana. Of the roughly 1,300 notices in Indiana's 2026 report, 31 give a larger total. The ranking of the largest 2026 breach notices puts these notices in order.

Record	What it counts	Number
Indiana attorney general	People affected in total	264,724
Indiana attorney general	Indiana residents	77

No HHS row under GIMA's name was found in the federal portal's current list on November 11, 2026.

What is GIMA offering people who got a letter?

Complimentary Experian IdentityWorks, for the number of months printed on each letter. The website notice says people whose sensitive information may have been involved get 12 months of credit monitoring, or longer where a state requires it, and that letters with enrollment directions would be mailed. Questions go to Aesto's response line, 833-918-8060, Monday to Friday, 8 a.m. to 8 p.m. Central time, with engagement number B167683. The guide to credit monitoring offers compares this offer with others.

Was my information in the GI Medicine Associates data breach?

If you got a letter from G.I. Medicine Associates about Aesto, your records were in the archive. If you were a patient and did not get one, GIMA may not have had a current address; the website notice is meant for that case, and Aesto's response line takes questions. Have the engagement number ready when you call.

What the documents leave open

• How the intruder got into Aesto's AWS environment.
• Why GIMA's Massachusetts letter lists fewer data types than its website notice.
• Whether GIMA's 264,724 patients are counted inside Aesto's federal total.