In July, CHARGE characterized 2026 as one of the “most disastrous for healthcare cybersecurity in recent memory.” IBM’s Cost of a Data Breach Report complemented that characterization with the numbers: for the thirteenth consecutive year, the healthcare industry was the most disrupted by cyber breaches.
That worrying trend has continued into September. On the 2nd, Maryland-based Luminis Health reported major EHR outages at its Anne Arundel and Doctors Community Medical Centers after “unauthorized criminal actors” disrupted systems across its network. Just a day later, on September 3, Aesto Health disclosed a major cyber breach affecting 9,540,683 patients across 37 serviced health providers. The breach exposed the
- full names;
- dates of birth;
- health insurance information;
- and Social Security numbers
of patients at affiliated networks, among other PHI.
An observability crisis
Both attacks, which centered around EHR and data exchange, illustrate one of the core vulnerabilities of software solutions within health organizations: observability. Aesto Health “provides secure data migration, legacy data archiving and electronic health record (EHR) exchanges” for providers. Threat actors accessed Aesto’s entered data environment by exploiting a misconfiguration of its Amazon Web Services (AWS) infrastructure.
That paints a sobering picture: third party vendors run the cloud networks of other third party vendors who steward PHI, sometimes without hospital knowledge. Where one vendor fails, or one cloud network is misconfigured, the whole security structure collapses. An AAWS breach is precisely the type of compromise that led IBM to identify cyber breaches as the results of “governance failures, not model risk” in 2026.
The risk surface is ballooning. According to IBM, at least one-in-four malicious data breaches are now AI enabled. AI-enabled breaches coupled with observability crises – providers addressed only 6% of identified cyber risks in the first half of 2026 compared to 23% in 2025 – makes a potent cocktail.
Multi dimensional risk
Now, more than ever, the structure of those AI breaches is multidimensional. Aesto, for example, automates extraction, transformation and structuring of legacy data, thereby preparing health data for downstream AI readiness. That is, AI pipelines ingest the types of clinical data prepared by firms like Aesto. A failure at Aesto -- or a vendor Aesto contracts with -- risks the AI security infrastructure for an entire health network.
Ultimately, the crisis is human. Industry benchmarking indicates that cyberattacks correlate to a 20% increase in in-patient mortality rates. Two weeks after the cyber attack, patients at Luminis Health are still struggling to access their medical records, and schedule the care they need – many patients are reporting intolerable delays for chemotherapy. A healthcare industry constantly threatened by cyber breach is structurally unstable and fails its primary mandate to help patients: 61% of healthcare leaders believe a patient fatality will result from a cyberattack at a U.S. healthcare facility within the next five years.
References
[1] https://www.hipaajournal.com/aesto-health-data-breach/
[3] https://foxbaltimore.com/news/local/luminis-health-cyberattack-maryland
