Visualização de leitura

Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Million Records

Aesto Health suffered a breach exposing personal and health data of more than 9.5 million people after attackers accessed its AWS infrastructure.

Aesto Health, a U.S. healthcare technology company, disclosed a data breach that exposed personal and health information belonging to more than 9.5 million people. The company discovered the incident on December 18, 2025, after attackers gained access to part of its Amazon Web Services infrastructure.

Aesto Health is a U.S. healthcare technology company based in Birmingham, Alabama. It helps healthcare providers manage and protect electronic health records and other legacy medical data. Its services include secure data migration, electronic health record (EHR) exchanges and long-term data archiving. Aesto works with medical practices and healthcare organizations that need to move, store or access patient information securely.

“On or about December 18, 2025, Aesto experienced a network security incident that impacted a limited portion of our Amazon Web Services infrastructure.” reads the Notice of Data Security Incident. “After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor.”

The company launched an investigation into the incident with external leading cybersecurity experts.

The network security incident affected part of its Amazon Web Services infrastructure between December 2 and 18, 2025. On May 26, 2026, Aesto confirmed that an unauthorized actor may have accessed or acquired protected health information stored in its network. Exposed data may include names, birth dates, medical and insurance information, driver’s license and government ID numbers, financial account details, taxpayer IDs and, for a limited number of people, Social Security numbers.

Aesto says it found no evidence of identity theft or financial fraud linked to the breach. Starting June 26, 2026, it notified affected healthcare clients whose patients’ data may have been accessed.

The company announced it has already implemented measures to strengthen security and set up a dedicated helpline for questions.

The healthcare firm also notified the US Department of Health and Human Services (HHS), reporting that the incident impacted 9540683 individuals.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Aesto Health)

Australian patients’ medical records could be sold on dark web after clinics’ data breach

‘Malicious actor’ obtains sensitive data including Medicare numbers, treatment details and pathology results in cyber-attack on Partnered Health

Australians’ medical records and patient information could be sold on the hidden market, an expert has warned, after a cyber-attack at one of the nation’s biggest healthcare providers.

Partnered Health revealed 21 clinics across several cities including Sydney, Melbourne and Canberra were affected when a “malicious actor” accessed its data on 23 June.

Continue reading...

© Photograph: Dominic Lipinski/PA

© Photograph: Dominic Lipinski/PA

© Photograph: Dominic Lipinski/PA

Palantir’s access to identifiable NHS England patient data is ‘dangerous’, MPs say

Health service has given US tech firm ‘unlimited access’ to certain data to build integrated platform, according to reports

MPs have warned that an NHS decision to grant Palantir access to identifiable patient information in its plan to use AI to improve the health service is “dangerous” and will fuel public fears that data privacy is not being prioritised.

NHS England has allowed staff from the US tech firm and other contractors to access patient data before it has been pseudonymised, despite internal fears of a “risk of loss of public confidence”, the Financial Times reported.

Continue reading...

© Photograph: David Levene/The Guardian

© Photograph: David Levene/The Guardian

© Photograph: David Levene/The Guardian

Norway to Introduce Social Media Age Limit of 16, Platforms to Enforce Verification

Norway social media age limit

The Norway social media age limit is moving closer to becoming law, with the government confirming it will introduce legislation this year to restrict access for children under 16. The proposal, expected to be presented to Parliament (Stortinget), aims to reshape how young users interact with digital platforms and place greater responsibility on technology companies for enforcing age restrictions. Prime Minister Jonas Gahr Støre said the move is designed to protect childhood experiences from being dominated by screens and algorithms. He emphasized that children should have space for play, friendships, and offline development, positioning the Norway social media age limit as a safeguard rather than a restriction.

How the Norway Social Media Age Limit Will Work

Under the proposed law, the Norway social media age limit will apply from January 1 of the year a child turns 16. This means access will be granted based on birth year rather than exact birthdate, ensuring that entire school cohorts are treated equally. In practice, most children will be at least 15 years old when they gain access. Minister for Children and Families Lene Vågslid explained that this approach addresses concerns raised during public consultations. Many respondents argued that differences based on birthdates could create social divides among peers. By aligning access with school cohorts, the government aims to balance protection with inclusion. “For me, it is important both to give better protection for children in the digital world and to listen to what young people are saying. I understand that social media can be an important social arena. We want to ensure inclusion and a sense of community. That is why we are proposing that the cutoff be based on the year of birth rather than the exact birth date, so that cohorts are given equal opportunities, regardless of when each person is born,” said Minister for Children and Families Lene Vågslid (Labour). At the same time, officials acknowledge that social media plays a role in young people’s social lives. The policy attempts to maintain that balance while reducing early exposure to potential harms linked to excessive screen time and online interactions.

Tech Companies to Enforce the Norway Social Media Age Limit

A key feature of the Norway social media age limit is the shift in responsibility to technology companies. Platforms will be required to implement effective age verification systems at login, ensuring that underage users cannot bypass restrictions. Minister of Digitalisation and Public Governance Karianne Tung made it clear that enforcement will not rely on children or parents alone. She stated that companies must take full responsibility for compliance and ensure that safeguards are operational from the first day the law takes effect. “I expect technology companies to ensure that the age limit is respected. Children cannot be left with the responsibility for staying away from platforms they are not allowed to use. That responsibility rests with the companies providing these services. They must implement effective age verification and comply with the law from day one,” said Minister of Digitalisation and Public Governance Karianne Tung (Labour). This approach aligns with broader European regulatory trends, particularly the Digital Services Act, which is expected to require platforms to take stronger accountability for user safety, including age verification measures.

Part of a Wider European Push

Norway is among the first countries in Europe to move forward with a nationwide social media restriction of this kind. However, it is not acting in isolation. Several European governments are exploring or advancing similar policies. In France, lawmakers have already backed a proposal to restrict social media use for children under 15, with strong support from President Emmanuel Macron. Spain has also announced plans to block access for users aged 15 and under, while the Netherlands is considering a minimum age of 15. In the United Kingdom, Prime Minister Keir Starmer has supported tighter controls, with pilot programs underway to assess the impact of limiting social media use among teenagers. These developments suggest that the Norway social media age limit is part of a broader shift across Europe toward stricter regulation of digital platforms and greater protection for minors.

Implementation Timeline and Next Steps

The Norwegian government plans to send the proposed legislation for consultation within the European Economic Area before the summer. This process typically lasts around three months. Full enforcement of the Norway social media age limit is expected once the Digital Services Act is incorporated into Norwegian law. Officials say recent trends support the move. Data indicates a decline in the number of children owning smartphones and using social media, partly due to national screen-time guidelines and initiatives such as mobile-free schools. The government intends to implement the policy in stages, but it has made clear that service providers are expected to begin compliance preparations immediately.

A Shift in Digital Policy

The Norway social media age limit reflects growing concern among policymakers about the impact of digital platforms on children’s mental health, privacy, and development. By placing legal responsibility on technology companies and aligning with European regulation, Norway is positioning itself at the forefront of this policy shift. As similar measures gain traction across Europe, the effectiveness of age verification and enforcement will be closely watched. The Norwegian model could become a reference point for other countries seeking to balance digital access with child protection.

Meta & YouTube Found Negligent: A Turning Point for Big Tech?

A landmark jury verdict has found Meta and YouTube negligent in a social media addiction case, raising major questions about platform accountability and legal protections under Section 230. This episode covers the details of the case, why the ruling is significant, and what it could mean for the future of social media, privacy, and cybersecurity. […]

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Shared Security Podcast.

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Security Boulevard.

💾

‘The bot asked me four times a day how I was feeling’: is tracking everything actually good for us?

Gathering data used to be a fringe pursuit of Silicon Valley nerds. Now we’re all at it, recording everything from menstrual cycles and mobility to toothbrushing and time spent in daylight. Is this just narcissism redesigned for the big tech age?

I first heard about my friend Adam’s curious new habit in a busy pub. He said he’d been doing it for over a year, but had never spoken to anyone about it before. He had a furtive look around, then took out his phone and showed me the product of his burning obsession: a spreadsheet.

This was not a record of his annual tax return or numbers he was crunching for work (Adam is a data scientist). Instead, it was a spreadsheet recording the minutiae of his life, with dozens of columns tracking every element of his daily routine. It all started, he told me, because of a recurring argument with his boyfriend. His partner didn’t think they spent enough time together, but Adam thought that they did. There was only one way to settle this, he decided: cold, hard data. So he began keeping a note of the days they saw each other and the days they didn’t.

Continue reading...

© Illustration: Carl Godfrey/The Guardian

© Illustration: Carl Godfrey/The Guardian

❌