2026 Astrana Health — social-engineering intrusion; private/confidential data exfiltrated (SEC 8-K)
Data compromised
Per SEC 8-K: certain private and/or confidential information on company servers accessed and/or acquired. Company still assessing whether patient, employee, credentialed provider, business/financial, IP, or other data was involved. Individual census unpublished.
Technical writeup
Verified Astrana Health, Inc. Form 8-K (Item 1.05) — filed ~September 23, 2026; materiality determined September 22, 2026. Subsidiary Astrana Health Management detected unusual activity after threat actors impersonated company personnel and spoofed the main corporate telephone number to contact employees and obtain unauthorized access. Company engaged a third-party forensics firm, notified law enforcement, and is notifying state/federal regulators and payer partners. Remediation: credential resets, restricted remote-access tools, restore of certain systems from clean backups, enhanced monitoring/logging/detection. Investigation ongoing on whether patient, employee, provider, confidential business/financial, IP, or other information was exfiltrated; company intends patient notifications if required. No named ransomware claim reported in coverage. Headcount unpublished — recordsAffected 0; companyConfirmed true.
Root cause
Threat actors spoofed Astrana’s main corporate phone number and impersonated personnel to socially engineer employees into granting system access (SEC Form 8-K Item 1.05)
References
- https://www.classaction.org/media/astrana-health-data-breach-sec-8-k-2026.pdf
- https://www.stocktitan.net/sec-filings/ASTH/8-k-astrana-health-inc-reports-material-event-d93383c2b914.html
- https://www.securityweek.com/astrana-health-data-breach-impacts-private-confidential-information/
- https://therecord.media/astrana-cyberattack-sec-ransomware