Lexington Hospital Corporation ("LHC") is providing this notice to inform individuals of a data security incident involving Aesto, LLC ("Aesto"), a third-party vendor that provided data migration and archiving services and maintained certain historical records on behalf of the facility. This notice describes what happened, what information was involved, what we are doing, and steps you can take to protect yourself.
Questions? Call our dedicated response line.
833-918-1116Available Monday through Friday, 8:00 a.m. to 8:00 p.m. Central Time, excluding major U.S. holidays. If you received a notice letter, please have your engagement number (printed on your letter) available when you call. This line will remain active for at least 90 days from the date of this notice.
What Happened
The records involved in this incident are historical records that predate LHC's acquisition of the facility in 2020. These records were maintained by Aesto, a vendor that provides data migration and archiving services. On or about December 18, 2025, Aesto experienced a network security incident that impacted a limited portion of its Amazon Web Services infrastructure. Aesto's core data platform was not compromised. Following an investigation, Aesto confirmed on May 26, 2026, that between approximately December 2, 2025, and December 18, 2025, certain information may have been accessed or acquired by an unauthorized actor. LHC received notice of this incident from Aesto on July 22, 2026.
The incident occurred solely within systems operated by Aesto. LHC's live clinical systems and current patient records were not affected, and the incident did not involve ransomware. There is no evidence at this time that any information has been misused.
What Information Was Involved
The information that may have been involved includes first name, last name, date of birth, and, for some individuals, Social Security number and medical record number. Not every data element was involved for every individual. If you received a notice letter by mail, your letter identifies the categories of information that applied to you.
What We Are Doing
Although the incident occurred at Aesto and involved historical records predating the 2020 acquisition, LHC is providing notice as required under the Health Insurance Portability and Accountability Act (HIPAA). We have reviewed the information provided by Aesto regarding its investigation and remediation. Aesto has reported that it secured the affected systems, reset credentials, enhanced monitoring and security measures, and confirmed that no further unauthorized activity has been observed. We have reported this incident to the U.S. Department of Health and Human Services, are mailing individual notices to affected individuals, and have established a dedicated response line.
We are also offering complimentary membership in Experian IdentityWorksSM identity protection services at no cost to affected individuals. Your mailed notice letter contains your personal activation code and your engagement number, both of which are needed to enroll. Adults enroll at experianidworks.com/1Bcreditmembership; parents and guardians enrolling on behalf of a minor use experianidworks.com/minorplus. Enrollment closes December 31, 2026, and activation codes will not work after that date. If you would like an alternative to enrolling online, or need assistance with identity restoration, call Experian's customer care team at 833-918-1116 and have your engagement number ready. If you believe you may be affected but did not receive a letter, please call the dedicated response line above.
What You Can Do
We have no evidence that any information has been misused because of this incident. Out of an abundance of caution, we recommend that you remain vigilant and take the following steps.
Enroll in the complimentary identity protection services. Use the enrollment website and activation code provided in your mailed notice letter. You must enroll by December 31, 2026 to receive the services; a credit card is not required.
Get your free credit reports. You are entitled to a free credit report every 12 months from each of the three national credit bureaus. Order online at AnnualCreditReport.com or call 1-877-322-8228. Review the reports for accounts or inquiries you do not recognize.
Consider a fraud alert. A one-year fraud alert is free and tells creditors to take extra steps to verify your identity before opening new accounts. Contacting any one of the three bureaus places the alert with all three.
Consider a security freeze. A security freeze is free and restricts access to your credit report until you lift the freeze. You must contact each bureau individually to place a freeze.
| Bureau | Fraud Alert | Security Freeze | Website |
|---|---|---|---|
| Equifax | 1-800-525-6285 | 1-888-298-0045 | equifax.com |
| Experian | 1-888-397-3742 | 1-888-397-3742 | experian.com |
| TransUnion | 1-800-680-7289 | 1-888-909-8872 | transunion.com |
Monitor your statements. Review your financial account statements and the explanation of benefits statements from your health insurer for any unusual or unrecognized activity. Contact your insurer or provider if you see services you do not recognize.
Watch for scams related to this incident. Be cautious of unsolicited calls, emails, or text messages that reference this incident. We will never ask you for your full Social Security number or bank account number over the phone. If you want to verify that a notice or call is legitimate, call the hospital's main number at (731) 968-3646 and ask for the Facility Privacy Officer, or call the dedicated response line listed on this page.
Report suspected identity theft. If you believe your information has been misused, contact the financial institution or company where the activity occurred, file a report with your local police department, and file a complaint with the Federal Trade Commission at IdentityTheft.gov or 1-877-IDTHEFT (1-877-438-4338). The FTC site provides a recovery plan tailored to your situation.
For More Information
If you have questions about this notice, please call 833-918-1116, toll-free, Monday through Friday, 8:00 a.m. to 8:00 p.m. Central Time (excluding major U.S. holidays), or email contact@lexingtonhospital.org. Please reference this notice when you contact us, and have your engagement number available if you received a letter. You may also write to us at:
Lexington Hospital Corporation
Attn: Facility Privacy Officer
200 W Church St.
Lexington, TN 38351
We sincerely regret any concern this incident may cause. Protecting the privacy of patient information is a core priority, and we continue to require strong safeguards from all vendors who handle patient data on our behalf.