Health Access Network Data Breach Investigation, Were You Affected? — Edelson Lechtzin LLP Probes Potential Claims

If you got a letter from Health Access Network about a data breach, you’re not the only one wondering what happens next — no lawsuit has been filed yet. A national law firm, Edelson Lechtzin LLP, is investigating whether Health Access Network patients have a legal claim after a vendor’s security incident may have exposed their names, Social Security numbers, and medical information.

Health Access Network Data Breach — Key Facts

Case Status	Pre-suit investigation. No lawsuit has been filed
Investigating Firm	Edelson Lechtzin LLP
Breach Window	Approximately December 2–18, 2025, inside vendor Aesto’s systems
Breach Discovered	On or about December 18, 2025, by Aesto. Scope confirmed May 26, 2026
Who Is Affected	Health Access Network patients whose information was processed by Aesto, LLC
Information Involved	Full names, Social Security numbers, and medical information — varies by individual
Reported To	New Hampshire Attorney General
Notices Mailed	Starting September 17, 2026
Free Credit Monitoring	Kroll identity monitoring offered to those whose Social Security numbers were involved
Cost to Consult	Free. No cost for a case evaluation
Last Updated	September 25, 2026

Who Are Health Access Network and Aesto, and Why Is a Law Firm Investigating?

Health Access Network, Inc. is a healthcare organization that relies on Aesto, LLC, a healthcare data migration and archiving vendor, to handle patient records. Aesto discovered suspicious activity inside a small part of its Amazon Web Services infrastructure in December 2025, and a later forensic review confirmed that patient files may have been accessed. Edelson Lechtzin LLP is now looking into whether Health Access Network and Aesto can be held liable for how that data was protected.

What Happened in the Health Access Network Data Breach?

Aesto says an unauthorized individual gained access to part of its network between roughly December 2 and December 18, 2025. It took until May 26, 2026, for Aesto’s forensic investigation and manual document review to confirm which patient files were actually touched. Aesto then informed Health Access Network around July 7, 2026, and Health Access Network started mailing notification letters to affected New Hampshire residents on September 17, 2026, along with an offer of Kroll identity monitoring for anyone whose Social Security number was involved.

Do the math on that timeline and it’s worth sitting with: about nine months passed between the breach itself and the first notification letters reaching patients. That gap — not just the breach — is often what data privacy attorneys focus on when they evaluate whether a company’s response met its legal obligations.

If this looks familiar, it should — a similar pattern played out with the WebTPA data breach, another healthcare vendor breach where a long gap between discovery and notification became a central issue once the lawsuits were filed, and which eventually turned into a $13.75 million settlement.

Right now, nobody’s been sued and nothing’s been paid out. This is the stage where a law firm decides whether the facts support a case — before any filing happens.

Do You Qualify for the Health Access Network Data Breach Investigation?

Here’s exactly how to know if this touches you.

• Health Access Network patients whose information was processed by Aesto, LLC
• Anyone who received a breach notification letter from Health Access Network starting September 17, 2026
• People whose notice mentioned a Social Security number, who also qualify for free Kroll monitoring
• Patients who haven’t received a notice yet but believe their information may have been involved

Health Access Network Patients Outside New Hampshire — Are You Still Covered?

Possibly. The notifications confirmed so far were sent to New Hampshire residents, since that’s the state Health Access Network reported the incident to. But the breach happened inside Aesto’s own infrastructure, which may serve Health Access Network patients in other states too. If you didn’t get a letter but think your information could have been involved, you can still request a free case evaluation to find out.

Not sure if you’re covered by the Health Access Network data breach investigation? A free, no-cost case evaluation with a data privacy attorney can help you find out before you decide whether to come forward.

Could You Get Money From the Health Access Network Data Breach?

No lawsuit has been filed yet, so there’s no settlement, no claim form, and no dollar figure to point to right now. If Edelson Lechtzin LLP or another firm files a class action and it eventually resolves, typical outcomes in healthcare data breach cases include compensation for documented losses, time spent responding to the breach, and free credit monitoring — but none of that exists yet for this case specifically.

What Might a Future Health Access Network Settlement Look Like?

Too early to say. The WebTPA case linked above is one example of where a similar healthcare-vendor breach eventually landed, but every case depends on how many people were affected, what the evidence shows, and how negotiations play out if litigation moves forward.

What Should Health Access Network Patients Do Right Now?

1. Confirm whether you’re affected — check for a notification letter, or contact Health Access Network directly if you’re unsure.
2. If your notice offered free Kroll identity monitoring, enroll before any stated deadline.
3. Consider placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion.
4. Save your notification letter and any related correspondence — it’s your proof if you decide to pursue a claim later.
5. Request a free, no-obligation case evaluation with a data privacy attorney investigating this breach, including Edelson Lechtzin LLP.
6. Watch for updates. If a lawsuit is filed, this article will be updated with the case name, court, and number.

Health Access Network Data Breach — Full Timeline

Milestone	Date
Unauthorized access window (within Aesto’s systems)	Approximately December 2–18, 2025
Aesto detects the incident	On or about December 18, 2025
Forensic investigation confirms scope	May 26, 2026
Aesto informs Health Access Network	On or about July 7, 2026
Health Access Network reports to New Hampshire AG	September 2026 (exact date UNVERIFIED)
Notices mailed to affected residents	Starting September 17, 2026
Edelson Lechtzin LLP announces investigation	September 24, 2026
Lawsuit filed	Not yet filed
Next development	UNVERIFIED — no lawsuit filed as of this writing

Health Access Network Data Breach — Frequently Asked Questions

Is there a lawsuit against Health Access Network right now?

 No. As of this writing, Edelson Lechtzin LLP is investigating potential claims, but no lawsuit has been filed against Health Access Network or Aesto.

Do I need to do anything right now if I got a Health Access Network breach notice?

 You should enroll in any free credit monitoring your notice offered and consider placing a fraud alert or credit freeze. Talking to an attorney is optional and doesn’t cost anything at this stage.

Is the Edelson Lechtzin LLP investigation into Health Access Network legitimate?

 Yes. Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California that regularly investigates and litigates data breach cases, including prior matters against other healthcare-adjacent companies.

What information was exposed in the Health Access Network data breach?

 Based on the notice sent to the New Hampshire Attorney General, the information involved varied by individual and may include full names, Social Security numbers, and medical information.

Will I have to pay anything to talk to a lawyer about this?

 No. Case evaluations for data breach investigations like this one are typically free, and attorneys in these cases are usually paid only if a case is filed and resolves in the class’s favor.

What if I didn’t get a notice but think I was affected?

 You can still request a free case evaluation. Notification letters confirmed so far went to New Hampshire residents, but the underlying breach happened inside a vendor’s systems that may serve patients elsewhere.

What’s the difference between an “investigation” and an actual lawsuit? 

An investigation means a law firm is gathering information and evaluating whether the facts support filing a case. A lawsuit means a formal complaint has been filed in court, with a case number, a judge, and a defendant required to respond.

How long do data breach investigations like this typically take before a lawsuit is filed?

 It varies. Some result in a filed class action within weeks; others take months, depending on how many people come forward and what the investigation turns up.

Sources Used in This Health Access Network Article

Edelson Lechtzin LLP — official press release via PR Newswire, Sept. 24, 2026: https://www.prnewswire.com/news-releases/health-access-network-data-breach-investigation-edelson-lechtzin-llp-probes-class-action-claims-after-patient-data-is-exposed-302889979.html

New Hampshire Department of Justice — Office of the Attorney General, Security Breach Notifications: https://www.doj.nh.gov/consumer/security-breaches/

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against Edelson Lechtzin LLP’s official press release on September 25, 2026. This article will be updated if a lawsuit is filed.

Last Updated: September 25, 2026.

This article is for informational purposes only and does not constitute legal advice. It also does not constitute an endorsement of any specific law firm. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.