Everside Health (Aesto, LLC) Data Breach Notice (Washington Attorney General)

The exposure of your Social Security number together with your full date of birth creates a permanent risk that cannot be undone. Combined with medical information, this filing means the affected individuals now face heightened chances of identity theft, fraudulent medical claims, and insurance abuse that could last for years.

21308 Washington patients learned months later

Everside Health (Aesto, LLC) filed notice with the Washington Attorney General on July 31, 2026, reporting a breach that occurred on December 02, 2025. That gap of 241 days — roughly eight months — is the most striking detail in the record. The filing states that 21,308 people were affected.

The categories listed are name, Social Security number, full date of birth, and medical information. No passwords or login credentials appear in the exposed data. This is genuinely good news: there is no immediate risk to any Everside Health account you may have, and you do not need to change any password connected to this provider.

What a Social Security number and date of birth actually enable

Together, a name, SSN, and date of birth form the core set of information required to open new credit accounts, file fraudulent tax returns, or apply for government benefits in someone else’s name. These pieces do not expire. Unlike a credit card or password, they cannot be reissued. Once they are out, they remain valuable to identity thieves for the rest of your life.

The addition of medical information increases the danger further. Criminals can use it to file false insurance claims, obtain prescription drugs, or create fake medical histories that complicate your own future care. Medical identity theft is often discovered only when a patient receives an unexpected bill or sees incorrect information on their insurance explanation of benefits.

Why the eight-month delay matters to you

The record shows the incident date as December 02, 2025, and the filing date as July 31, 2026. Washington law requires notification “without unreasonable delay,” but timelines vary depending on when an investigation concludes and when affected individuals can be identified. The filing itself does not disclose when Everside Health discovered the incident or how long the data may have been accessible. What is certain is that more than seven months passed between the recorded breach date and the official notification to the state.

During that period, anyone whose records were taken had no way to know their information was exposed. This delay is the central newsworthy fact of this particular filing.

The records belong to patients

The 21,308 individuals named in this filing are patients whose information was held by Everside Health. The record does not state whether every person had all four categories exposed; it lists the types of information involved in the incident. Your own notification letter, if you received one, is the only document that can confirm exactly which details applied to you.

If you have not received a letter from Everside Health, it is likely that your records were not part of this group. Letters are sent to the last known address on file. Anyone who has moved since December 02, 2025 should contact Everside Health directly to confirm whether they were affected.

What cannot be fixed and what still can

Your date of birth and Social Security number are now permanently linked to this breach. Medical details cannot be changed either. These facts will remain true no matter what steps you take today.

What you can still control is how closely you monitor the downstream consequences. The exposure does not mean thieves have already used your information, only that they now possess the tools that make misuse possible. Early detection is the most effective defense available.

Placing the risk in context

A Social Security number paired with a date of birth is the exact combination lenders and government agencies use to verify identity. Medical information adds a second vector for fraud that targets your insurance rather than your credit. Both risks are real, but both can be managed with consistent monitoring rather than panic.

Because no passwords were exposed, this incident does not threaten your existing Everside Health patient portal access or any other account that relies on credentials you control. That distinction matters. Many breach notifications create immediate account takeover risk; this one does not.

Medical identity theft is often invisible at first

Unlike credit fraud, which usually triggers alerts from banks, medical fraud can remain undetected for months. You may not learn about it until you are denied coverage, receive bills for care you never received, or discover that your insurance has reached its limit because of claims filed by someone else.

Regular review of Explanation of Benefits statements from every insurer you use is the only reliable way to catch this early. The filing’s inclusion of medical information makes this step more important than it would be in a breach that exposed only financial data.

The letter is the definitive check

Everside Health is required to notify affected patients directly, usually by mail. If you have not received such a letter, your information was almost certainly not included. However, if you have changed addresses at any point since the December 02, 2025 incident date, it is worth verifying directly with the organization. Absence of a letter remains the strongest practical indicator that you were not affected.

Long-term consequences of SSN exposure

Once a Social Security number is publicly linked to your name and date of birth, it can be sold on dark-web markets and reused in multiple fraud schemes over many years. Tax identity theft, employment fraud, and synthetic identity creation all become easier. Credit freezes and fraud alerts slow some of these attacks but do not eliminate the underlying permanence of the exposure.

This is why the combination of SSN and full date of birth is treated as especially serious by regulators and identity protection services. The medical information simply widens the possible attack surface.

Concrete monitoring steps that address this exact exposure

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion immediately. This forces lenders to verify your identity before opening new accounts in your name.
• Review every Explanation of Benefits statement from your health insurers. Look for claims you did not file or services you did not receive.
• Obtain and examine your free annual credit reports. Check for accounts or inquiries you do not recognize.
• Sign up for free IRS Identity Protection PIN notifications to block fraudulent tax filings using your SSN.
• Contact Everside Health directly if you moved after December 2025 and have not received any notification, to confirm your status in this filing.

The record contains no information about how the breach occurred, whether the data was copied, or what security measures were in place. Those details remain undisclosed. What the filing does establish is that 21,308 patients had their name, Social Security number, full date of birth, and medical information listed in connection with an incident on December 02, 2025, and that Washington residents were notified eight months later.

That combination of facts is what matters for the people whose records were included. The exposure cannot be reversed, but its consequences can still be limited through deliberate, ongoing vigilance focused on credit, taxes, and medical billing.