Catalyst Physician Group Data Breach: Edelson Lechtzin LLP Launches Investigation Into Exposure of Protected Health Information

National class action firm Edelson Lechtzin LLP is offering free case evaluations to individuals affected by the Catalyst Physician Group data breach, which originated at a third-party vendor and may have exposed patient names and protected health information.

PLANO, Texas, Sept. 16, 2026 /PRNewswire/ -- Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Catalyst Physician Group data breach. The incident originated at Aesto, LLC (doing business as Aesto Health), a healthcare technology vendor that provides data migration and archiving services for Catalyst Physician Group. Catalyst Physician Group's own systems were not accessed.

Key Facts at a Glance

• Company: Catalyst Physician Group — a physician-owned, physician-led primary care organization serving the Dallas–Fort Worth Metroplex, Texas.
• Source of the breach: A network security incident at vendor Aesto, LLC affecting a limited portion of its Amazon Web Services infrastructure.
• When access occurred: On or about December 2, 2025, through December 18, 2025.
• When confirmed: Aesto confirmed the affected data on May 26, 2026.
• Individuals notified: Notice letters dated September 11, 2026.
• Information exposed: Patients' full names and other protected health information that varied by individual.
• People affected: Not publicly disclosed for Catalyst Physician Group; the broader Aesto incident was reported to federal regulators as affecting roughly 9.5 million individuals across its healthcare provider clients.
• Regulator notified: California Attorney General.

What Happened
Aesto, LLC experienced a network security incident on or about December 18, 2025 that affected a limited portion of its Amazon Web Services infrastructure, where patient records tied to Catalyst Physician Group were stored. After a forensic investigation and manual document review, Aesto confirmed on May 26, 2026 that an unauthorized actor may have accessed or acquired data between December 2 and December 18, 2025. Catalyst Physician Group's own systems were not involved. Notice letters to affected individuals are dated September 11, 2026.

What Information Was Exposed
The breach may have compromised patients' full names and other protected health information that varied by individual. Because health data can support medical identity theft, insurance fraud, and targeted phishing, affected patients should remain vigilant.

Catalyst Physician Group's Response
Catalyst Physician Group is offering affected individuals complimentary identity theft protection through IDX, including credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services. The enrollment deadline is December 11, 2026.

Your Legal Options
Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies on behalf of individuals whose sensitive personal data may have been compromised in the Catalyst Physician Group breach. The firm will evaluate your rights and potential claims at no cost.

Recommended Protective Steps

• Preserve your breach notification letter and enroll in the IDX protection before the December 11, 2026 deadline.
• Review Explanation of Benefits statements, medical records, and financial accounts for unfamiliar activity.
• Consider placing a fraud alert or credit freeze, and be cautious of phishing messages referencing your care or provider.

Contact Us for a Free Case Evaluation
Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: [email protected]; Web: www.edelson-law.com. Or click HERE to request a free consultation.

About Catalyst Physician Group
Catalyst Physician Group is a physician-owned, physician-led primary care organization serving patients across the Dallas–Fort Worth Metroplex in Texas.

About Edelson Lechtzin LLP
Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions.

SOURCE Edelson Lechtzin LLP