Tapestry 360 Health data breach: what patients need to know now

Between December 2 and December 18, 2025, someone got unauthorized access to part of the online systems run by Aesto Health, a technology vendor used by health centers. On May 26, 2026, Aesto confirmed that some patient health information from its clinic clients — including Tapestry 360 Health, a Chicago-area community health center — may have been viewed or copied. Aesto told those clinics on June 26, 2026. Tapestry 360 Health then started mailing letters to patients. Vermont’s attorney general recorded the incident on August 12, 2026, and said seven Vermont residents were affected. Massachusetts published the sample letter sent to residents there.

Aesto says that, across all of its affected clinic clients, the information that may have been involved includes names, dates of birth, medical information, health-insurance details, driver’s-license numbers, financial-account numbers, taxpayer-identification numbers, other government IDs, and Social Security numbers for a limited number of people. Aesto says it has no evidence of identity theft or financial fraud. Tapestry 360 Health’s website currently sends patients to Aesto’s notice. Neither organization has said how many people were affected nationwide, or how many of them were Tapestry patients.

The official notices treat this like a credit-card problem

Read the letters and you will hear the same notes: a “limited” slice of Aesto’s systems, information that “may have been” reached, no identity theft found, and two years of credit monitoring. Those points are what the vendor and the clinic chose to lead with. They are not false. They are incomplete in a way that matters if you actually went to that clinic.

What a stranger can use, if your record was in the systems that were reached, is not a card number to spend. It is your name and birth date attached to medical information and health insurance — and, for some people, a Social Security number or driver’s license. That combination is how medical identity theft works: care booked in your name, claims run through your insurer, a mixed-up chart that follows you to the next doctor. Credit monitoring does not watch any of that. A bill or an insurance statement for a visit you never made is the warning, and it will not show up next to your credit score.

“Limited” describes Aesto’s computers, not you. Either your information sat in that slice or it did not. Because no total has been published, there is no public list to consult and no website that can honestly tell you whether you were included. The mailed letter is the signal Tapestry is using. Patients who received letters were hearing about an intrusion from the previous December. And “we have seen no fraud so far” is a statement about what Aesto says it knows today — not a finding that a copy taken in December 2025, if it was taken, is sitting unused.

What to actually expect

• If Tapestry 360 Health considers you affected, you should get a letter in the mail. The Massachusetts sample letter offered 24 months of credit monitoring and a dedicated call line at [phone withheld] (engagement number B167683). The letter states the notice was not held back by law enforcement.
• There is no public list of affected patients, and no website can honestly tell you whether you were included. Tapestry is notifying people by mail. If a letter has not arrived, that is not something a scan or a third party can double-check for you.
• Do not expect your bank account to be emptied next week. Aesto says it has not seen identity theft or financial fraud from this incident. If anything shows up, it is more likely to be a medical bill or an insurance “explanation of benefits” for care you did not receive — and that can appear months later.
• If you enroll in the monitoring from the letter, it will watch for new credit in your name. It will not alert you to someone using your identity at a clinic or billing your health plan.

What you can and cannot fix

If your name, date of birth, medical information, insurance details, driver’s license, or Social Security number were in the files that were reached, that copy is out. It cannot be taken back. No clinic, vendor, lawyer, or cleanup service can delete it from whoever obtained it.

• If a letter arrived, enroll in the 24 months of credit monitoring they are already paying for, using the phone number and engagement number printed in that letter. That is the one remedy attached to this specific incident.
• If a Social Security number or driver’s license may have been involved, put a credit freeze on your files at Equifax, Experian, and TransUnion. A freeze is stronger than monitoring if the goal is to stop someone opening new credit in your name.
• Read every medical bill and every insurance explanation of benefits. If you see care you did not get, call the insurer and the listed provider and dispute it. That is the step that actually matches what may have been exposed here.
• Cut back what people-search sites publish about you — relatives, phone numbers, employers, and old addresses. A bare clinic record becomes more useful to a stranger when it can be joined to those extra details. The leaked record itself cannot be removed. Those listings often can.