Were You Affected by the HealthFirst Bluegrass Data Breach?
Edelson Lechtzin LLP is investigating claims on behalf of patients whose Social Security numbers and health records may have been exposed in a breach tied to vendor Aesto Health. Find out if you qualify — free and confidential.
Request Your Free Case Evaluation → No cost. No obligation. Speak confidentially with a data privacy attorney.
What You Need to Know
HealthFirst Bluegrass has disclosed a data breach traced to a security incident at Aesto Health, a data migration and archiving vendor. The breach exposed patients’ Social Security numbers and health records, and was reported to the Vermont Attorney General on or about August 27, 2026. If you were a patient, you may have legal options — and you may be entitled to compensation.
What Happened
HealthFirst Bluegrass, a multispecialty healthcare system serving the Lexington, Kentucky area, disclosed a breach linked to Aesto Health. According to notices, a network security issue affected Aesto Health’s Amazon Web Services infrastructure between December 2 and 18, 2025, exposing information about individuals connected to its clients. HealthFirst Bluegrass reported the breach to the Vermont Attorney General on or about August 27, 2026.
What Information Was Exposed
The breach may have compromised:
- Social Security numbers
- Names
- Health records
The combination of Social Security numbers and health records raises the risk of both financial identity theft and medical identity theft.
Am I Affected?
Any current or former patient who receives a breach notification from HealthFirst Bluegrass may face a heightened, long-term risk of identity theft and fraud. The notification letter is the most reliable confirmation that your information was involved. If you have any doubt, we can help you find out.
Steps You Can Take Now
- Freeze your credit with all three bureaus — Equifax, Experian, and TransUnion. It is free and takes minutes.
- Set up fraud alerts and monitor your credit reports and account statements.
- Review medical bills and insurance statements for services you did not receive.
- Watch for phishing — breach notices are a common disguise. Do not click links in unexpected messages.
- Preserve any letters or emails you receive about the breach.
Your Legal Rights
Edelson Lechtzin LLP is investigating a potential class action on behalf of patients whose sensitive data was compromised in the HealthFirst Bluegrass breach. The firm will evaluate your rights and potential claims at no cost to you.
Start Your Free, Confidential Case Review →
Frequently Asked Questions
Does it cost anything to talk to a lawyer? No. Your case evaluation is free and confidential, with no obligation to move forward.
The breach was at a vendor, not HealthFirst Bluegrass — can I still have a claim? Possibly. Organizations that entrust patient data to vendors can still bear responsibility when that data is exposed. An attorney can evaluate your specific situation.
How do I know if my information was exposed? The most reliable confirmation is a notification letter from HealthFirst Bluegrass. If you received one, or believe you may be affected, contact us.
How much time do I have to act? Legal claims are subject to deadlines that vary by state. It is best to speak with an attorney as soon as possible.
About HealthFirst Bluegrass
HealthFirst Bluegrass is a federally qualified health center (FQHC) that provides integrated healthcare to everyone, regardless of insurance or ability to pay.
About Edelson Lechtzin LLP
Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. The firm handles data breach, securities fraud, antitrust, ERISA, wage theft, and consumer fraud matters.
Contact: Marc Edelson, Esq. | 411 S. State Street, Suite N-300, Newtown, PA 18940 Phone: 844-696-7492 | Email: [email protected]
Request Your Free Case Evaluation →
This website may be considered Attorney Advertising in some jurisdictions. Prior results do not guarantee a similar outcome. Contacting the firm does not create an attorney-client relationship.