Between December 2 and December 18, 2025, someone got unauthorized access to part of the online systems run by Aesto Health, a technology vendor used by health centers. On May 26, 2026, Aesto confirmed that some patient health information from its clinic clients — including Tapestry 360 Health, a Chicago-area community health center — may have been viewed or copied. Aesto told those clinics on June 26, 2026. Tapestry 360 Health then started mailing letters to patients. Vermont’s attorney general recorded the incident on August 12, 2026, and said seven Vermont residents were affected. Massachusetts published the sample letter sent to residents there.
Aesto says that, across all of its affected clinic clients, the information that may have been involved includes names, dates of birth, medical information, health-insurance details, driver’s-license numbers, financial-account numbers, taxpayer-identification numbers, other government IDs, and Social Security numbers for a limited number of people. Aesto says it has no evidence of identity theft or financial fraud. Tapestry 360 Health’s website currently sends patients to Aesto’s notice. Neither organization has said how many people were affected nationwide, or how many of them were Tapestry patients.
The official notices treat this like a credit-card problem
Read the letters and you will hear the same notes: a “limited” slice of Aesto’s systems, information that “may have been” reached, no identity theft found, and two years of credit monitoring. Those points are what the vendor and the clinic chose to lead with. They are not false. They are incomplete in a way that matters if you actually went to that clinic.
What a stranger can use, if your record was in the systems that were reached, is not a card number to spend. It is your name and birth date attached to medical information and health insurance — and, for some people, a Social Security number or driver’s license. That combination is how medical identity theft works: care booked in your name, claims run through your insurer, a mixed-up chart that follows you to the next doctor. Credit monitoring does not watch any of that. A bill or an insurance statement for a visit you never made is the warning, and it will not show up next to your credit score.