The Data Breach Brief: Week of August 19th, 2026

The following data breaches have been announced this week—make sure you’re in the know.

If you received a data breach notice regarding any of the breaches listed below, act now and take Morgan & Morgan’s data breach quiz to see if you may be eligible for compensation.

Aesto, LLC

Aesto, LLC, suffered a data breach between December 2, 2025, and December 18, 2025, when an unauthorized actor may have accessed or acquired protected health information stored on Aesto’s network, a security incident involving part of its Amazon Web Services (AWS) infrastructure. The potentially compromised information may include:

• Names
• Social Security numbers
• Medical information
• Health insurance information
• Other sensitive information

Everside Health

Following the Aesto, LLC, data breach, Everside Health, along with many other healthcare providers, may have been affected, as Aesto Health is a third-party vendor. Investigations are underway to determine whether Everside and its third-party vendor implemented reasonable cybersecurity safeguards to protect patients’ sensitive information and whether additional security measures could have prevented this incident. The potentially compromised information may include:

• Names
• Social Security numbers
• Medical information
• Health insurance information
• Other sensitive information

Lennar Corporation

Lennar Corporation suffered a data breach between March 24, 2026, and March 30, 2026, when an unauthorized party used social engineering to access some of its systems containing sensitive personal information. The information involved may include: 

• Names
• Contact information
• Additional data elements

CSC

CSC, formally known as Corporation Service Company, suffered a data breach after ransomware group CL0P accessed its network and claimed responsibility for an October 2025 dark web leak. However, CSC did not report the breach to the Vermont Attorney General until August 2026—ten months later. The compromised data included highly sensitive personal information of over an estimated 2,000 people and included:

• Names
• Social Security numbers
• Government-issued IDs
• Financial details
• Dates of birth

See's Candies

See's Candies suffered a ransomware attack between April 11 and April 13, 2026, which was officially reported to the California Attorney General on August 13, 2026. The cybercriminal group Qilin claimed responsibility and leaked data subsets containing sensitive, private information of over 110,000 data rows/individuals, including: 

• Names
• Addresses
• Emails
• Phone numbers
• Birthdays
• Social Security numbers

If you or a loved one were affected by any of these data breaches, you may be entitled to compensation. Find out more in minutes with our online data breach quiz.