Nebraska Orthopaedic Center (Aesto, LLC) Data Breach Notice (Washington Attorney General)

The Nebraska Orthopaedic Center notified 992 Washington patients that their most sensitive personal and medical records were exposed in an incident that occurred on December 02, 2025. The organization filed the notice with the Washington Attorney General on August 19, 2026 — 260 days later.

A Social Security Number paired with your date of birth does not expire

If you were among those notified, the combination now in circulation is one of the hardest to outrun. Lenders, government agencies, and many healthcare systems still rely on that exact pair to verify identity. Once it leaves a secure environment it cannot be replaced like a credit card or password. The same is true of the medical information tied to your name. These records do not become less useful to fraudsters over time; they often become more valuable as they accumulate additional public data points about you.

The filing lists four categories: name, Social Security number, full date of birth, and medical information. No passwords or login credentials appear in the exposed data. That absence is genuine good news. It means the breach does not put any Nebraska Orthopaedic Center patient portal account at direct risk of takeover. You do not need to change a password for this specific incident.

What the 260-day gap actually tells you

The incident date and the filing date are both public. Between December 02, 2025 and August 19, 2026 sits a gap of roughly eight and a half months. Notification timelines vary by state law and by when an internal investigation concludes. The record does not explain the length of that interval, but its existence is the single most concrete fact a reader can act on. It means any protective steps you take now are happening long after the information first became available to whoever accessed it.

Why medical information makes this breach different

Medical details tied to your name and date of birth create risks that purely financial data does not. Insurance fraud, prescription forgery, and the creation of fake patient files for billing all become easier when an attacker already holds verified clinical information. Unlike a credit card number, you cannot simply cancel your medical history. The combination of these four categories gives a fraudster a credible foundation for both identity theft and medical identity theft that can persist for years.

The organisation is required to notify affected individuals directly, usually by mail. If you have not received a letter from Nebraska Orthopaedic Center, it is likely your records were not part of the 992 affected. However, anyone who has moved since December 02, 2025 should contact the center directly to confirm whether they were included. Absence of a letter is meaningful but not absolute proof.

The permanent pieces you cannot change

Your Social Security number and exact date of birth are now permanently linked to your name and medical history in an external dataset. These identifiers cannot be reissued at will. That reality shifts the burden from prevention to lifelong monitoring. The exposure does not guarantee you will become a victim, but it does mean the material needed for synthetic identity fraud or tax refund theft is now outside the clinic’s control.

How this exposure can be used against you

A name, SSN, and date of birth together allow someone to apply for credit, open bank accounts, or file tax returns in your name. Adding medical information raises the possibility of submitting false insurance claims or obtaining prescription drugs under your identity. These are not theoretical risks; they are the standard playbook once that specific quartet leaves protected systems.

Because the breach involves medical records, it also creates a secondary privacy concern. Someone with access to your clinical notes could attempt to leverage that information for blackmail, employment discrimination, or insurance manipulation. While the filing does not indicate that level of access occurred, the categories listed make those scenarios possible.

What remains under your control

You cannot retract the data, but you can limit what an attacker is able to do with it. The key is rapid detection and consistent friction. Credit freezes, fraud alerts, and regular checks of Explanation of Benefits statements become essential rather than optional. Medical identity theft often surfaces first through unexpected bills or denied claims, so reviewing insurance documents every month is one of the few early-warning systems available.

Placing the risk in context

992 people were affected according to the filing. That is a meaningful number for a specialized orthopaedic practice, yet it represents only those whose Washington addresses triggered this specific notification. The record does not state how the incident occurred, whether a vulnerability, misconfiguration, or external party was involved, or how long the information may have been accessible. Those details remain outside what the Attorney General’s filing discloses.

The absence of any credential exposure is worth repeating. This is not a case where patient portal logins were compromised. The threat is identity-based and medical-based rather than account takeover. That distinction matters when deciding where to spend your attention.

Practical steps that address this exact exposure

• Place a credit freeze with Equifax, Experian, and TransUnion immediately. This stops new credit applications using your SSN without your direct approval and is the single most effective barrier against the type of identity theft this breach enables.
• Set up an extended fraud alert for 90 days, then renew it. This forces creditors to verify your identity by phone before issuing new credit and adds a visible flag that many fraudsters avoid.
• Review every Explanation of Benefits statement from your health insurer. Look for services you did not receive. Medical identity theft is often discovered only after claims appear for treatment you never had.
• Request your annual free credit reports and scan for accounts or inquiries you do not recognize. Do this every four months rather than once a year while the risk window remains open.
• Contact Nebraska Orthopaedic Center directly if you have moved since December 2025 or never received a notification letter. Confirm whether your specific record was in the affected group.

The information exposed in this incident will remain sensitive for the rest of your life. The 260-day delay between the December 02, 2025 incident and the August 19, 2026 filing simply means protective measures are starting later than ideal. Consistent monitoring and the credit freeze are the tools that convert a permanent risk into a managed one. Most people who take these steps early never experience the worst outcomes, even when their data sits in the hands of unknown parties.