Retired patient and customer records earn nothing, often sit with a vendor no one reviewed, and still carry the full cost of a breach. Diligence rarely maps them.
Transaction residue
BleepingComputer’s 1 September 2026 report on Aesto Health matters to deal teams for one specific reason. Aesto LLC, trading as Aesto Health, disclosed a breach affecting 9,540,683 individuals, as reported to the U.S. HHS Office for Civil Rights. Individual notifications began on 21 August 2026. What makes the case instructive is the company’s business model. Aesto sells software that migrates, archives, and provides access to patient data when a healthcare organisation replaces its electronic health record system or when a practice is acquired. Its product exists to hold data that a provider has stopped using day to day, often as the result of a transaction.
According to the public reporting, an unauthorised actor reached protected health information in part of Aesto’s Amazon Web Services environment between about 2 and 18 December 2025. Aesto confirmed internally on 26 May 2026 that patient information may have been taken, and posted a public notice on 24 June 2026. The incident reached 29 downstream healthcare organisations that had contracted Aesto to hold records from system migrations and practice acquisitions. The exposed fields included names, dates of birth, medical information, driver’s license numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government identifiers, and Social Security numbers. Public reporting called it the second largest confirmed U.S. healthcare data breach of the year to date.
For an investor, the useful point is narrower than the headline. Dormant data can create current liability, and the value at risk has little to do with whether anyone still uses the data.
The part of the target diligence tends to skip
Cyber diligence usually follows the business model. It examines the systems that generate revenue, run operations, authenticate users, process payments, and hold current records. That focus is rational, and it is also incomplete.
In a healthcare buy-and-build, the operating environment is a stack of past decisions. A practice was acquired. Its record system was replaced. A billing platform was retired. Historical records were migrated, partly converted, or moved to an archive. The live system becomes the diligence subject. The old data becomes background.
Sometimes that archive sits with the target. Sometimes it sits with a migration vendor. Sometimes it sits with an archival provider that a predecessor entity contracted years ago. Often the current management team can name the vendor but has not re-read the contract, checked the retention schedule, tested the access model, or seen evidence that anything was deleted.
That is the gap. Diligence maps the systems that run the company. It rarely maps the data the company stopped using. The sensitivity of that data does not fall when the workflow retires. Medical information, tax identifiers, financial account numbers, and insurance details still carry notification duties, regulatory exposure, and litigation risk if they leak. An archive that earns nothing can still cost a great deal.
Why serial acquirers carry more of this
The problem compounds with each deal. Every acquired practice can bring its own patient history, local systems, outside IT provider, migration path, and archive. Every integration can leave another pool of legacy records. Over time a platform accumulates datasets that no longer appear on any operating diagram.
The board pack shows integration progress. The diligence report shows consolidated system coverage. The synergy model assumes retired platforms. None of that proves the underlying data was minimised, encrypted, access-controlled, or contractually governed. A vendor first chosen to solve one local migration can quietly become the repository for records from many acquired entities, sitting outside the current vendor-management process because the contract is old and the service is low-touch.
Verizon’s 2025 Data Breach Investigations Report gives the backdrop. Across 12,195 confirmed breaches, third-party involvement doubled from 15 percent to 30 percent year over year, the largest single-year move in the report’s 18-year history. That says nothing about any one target, but it shows why inherited vendor dependencies deserve attention in deal work.
Where the valuation impact sits
This is a valuation question, not a technical one. A dormant archive offers no growth, no margin, no cross-sell. If it is breached, the cost scales with the number and sensitivity of records, not with how useful the data still is.
IBM’s Cost of a Data Breach 2025 put the global average breach at 4.44 million dollars, with detection and escalation near 1.47 million, post-breach response near 1.38 million, lost business near 1.20 million, and notification near 0.39 million. The same study ranked supply chain compromise as the second most frequent initial attack vector at 15 percent, the second most costly at 4.91 million dollars on average, and the slowest to contain at 267 days against a 241-day average. These are benchmarks, not deal arithmetic. A per-record figure should not be multiplied by 9,540,683 to produce a breach cost, because per-record numbers do not scale linearly to breaches of that size. The reason to hold the benchmarks in view is to recognise a cost category that may be missing from the investment case altogether.
Regulatory exposure is the second component. Protected health information carries HIPAA duties, and state breach laws may apply on top. The question for a buyer is not whether the target has a privacy policy. It is whether the target can show where legacy patient data sits, who holds it, how it is protected, how long it must be kept, and when it can be destroyed.
Trust is the third. A patient does not distinguish between a live record and an archived one held by a migration provider. They see the current brand and the sensitivity of the information. In a roll-up where local reputation is part of the thesis, that matters.
The FAIR framework helps structure the conversation. Risk is loss event frequency multiplied by loss magnitude, and loss magnitude separates primary loss, such as response and replacement, from secondary loss, including fines, judgments, and reputation. A FAIR analysis produces a loss distribution, usually a 10th, 50th, and 90th percentile figure, rather than a red, amber, or green label. That range is what belongs in the valuation discussion, and in the indemnity, escrow, and closing-condition discussions that follow.
What to ask before exclusivity
The questions are practical. Ask for a data map that includes retired systems, historical archives, and migration stores, covering data categories, record counts, legal basis for retention, storage location, access paths, encryption, and deletion dates. Ask for the list of migration, archival, and system-transition vendors used across prior acquisitions, including those inherited through acquired entities and any named sub-processors.
Ask for evidence rather than description: retention schedules, deletion certificates, archive inventories, access reviews, security attestations, breach-notification clauses, and business associate agreements where health data is involved. Then ask what happens if the evidence is missing. That is where terms move. The buyer may need a specific indemnity for legacy data exposure, an escrow sized to a reasoned loss range, a covenant requiring deletion or vendor remediation before closing, or a closing condition where the data population is large, sensitive, and poorly mapped.
None of this turns diligence into archaeology. It treats retired data as a liability to be governed or lawfully deleted. Where nobody can prove which applies, the uncertainty gets priced.
The decision
Most of the time, legacy data exposure should not end a deal. It should change price, structure, escrow, indemnity, and the first hundred days after close. Occasionally it should slow the process. A target under exclusivity that cannot say where acquired patient data sits is asking the buyer to take on a liability without a map.
The Aesto Health breach is a clean illustration. The data was not exposed because it was current. It was costly to notify, sensitive to patients, and material to 29 downstream organisations because it still existed. The diligence question follows from that. Not only which systems run the business, but which data the business left behind.