Astrana Health, a healthcare management services company, has told the U.S. Securities and Exchange Commission that attackers posing as its own staff, and calling from what looked like its main corporate phone number, targeted employees in an effort to get into company systems. The company says it believes confidential data on its servers was accessed or acquired without authorization. It filed a Form 8-K under Item 1.05, the disclosure item for material cybersecurity incidents, on September 23, 2026, one day after it determined on September 22 that the incident was material.
The filing gives no number of affected people, and it does not say whether any particular person's records were taken. The company's review was still under way when it filed.
What the filing says happened
According to the 8-K, subsidiary Astrana Health Management, Inc. detected unusual activity within its environment. The incident involved a series of social engineering attempts "in which threat actors, impersonating Company personnel and spoofing the Company's main corporate telephone number, contacted certain employees." The filing says the calls were made "in an effort to obtain unauthorized access to Company systems." HIPAA Journal, summarizing the filing, reported that the callers tricked employees into providing them with access.
The company's conclusion about the result is direct. It said it believes "certain private and/or confidential information maintained on the Company's servers has been accessed and/or acquired without authorization." It said the incident is material "due to the potential confidential and sensitive nature of the data that is involved."
The 8-K does not name the systems that were reached, how long the attackers had access, or which accounts the impersonation calls compromised. It also does not give the date the unusual activity was first detected, saying only that the company "recently became aware" of it. Astrana said it will amend the filing as information required by Item 1.05(a) is determined or becomes available.
Who may be affected
HIPAA Journal, which reported on the filing on September 29, describes Astrana as "a managed services organization that helps healthcare providers deliver value-based, coordinated care to patients." The 8-K says the company is still assessing whether, and to what extent, the following kinds of information may have been accessed, acquired or exfiltrated:
- patient information
- employee information
- credentialed provider information
- confidential business and financial information
- intellectual property
These are categories under review, not confirmed exposures. The Lyon Firm, a law firm investigating the incident, notes on its case page that Astrana has not released a full inventory of the data elements involved or the number of people affected. The company said in the filing that it intends to make all required notifications based on its findings, including to impacted patients. Until Astrana or a regulator publishes a count, the scale of the incident is unknown.
What is known and what is not
Stated by the company in the 8-K:
- It believes private or confidential information on its servers was accessed or acquired without authorization.
- It is unable to estimate the full potential impact of the incident on its business, operations or financial condition, but it currently does not expect the incident to have a material effect on its financial condition and results of operations.
- It holds cybersecurity insurance that may cover certain losses, with no assurance that the coverage will be sufficient.
Not yet known:
- How many patients, employees or providers are affected.
- Which specific data elements were taken.
- Who carried out the attack. HIPAA Journal reported that no ransomware or cybercriminal group "appears to have claimed responsibility." The filing does not attribute the intrusion to anyone.
The 8-K does not mention ransomware or the encryption of systems.
The company's response
According to the filing, Astrana's cybersecurity team detected and responded to the activity, launched an investigation and engaged a third-party cybersecurity and digital forensics firm. Its remedial measures included resetting affected credentials, restricting remote access tools, restoring certain systems from clean backups, and enhancing monitoring, logging and detection capabilities across its environment. The filing does not say whether the attackers used remote access tools.
Astrana also said it notified law enforcement and is notifying state and federal regulators and its payer partners. "The trust of our valued providers, patients, and payer partners is deeply important to us, and we regret any concern or inconvenience this may cause," the company said in the 8-K.
What It Means for Defenders
- Don't trust caller ID for identity. Staff should confirm a caller's identity through a separate channel, such as calling back a number from the internal directory or using a manager-approved verification step, before resetting credentials or granting access to systems.
- Control remote access tooling. Inventory the remote support and remote access tools that are installed and allowed, block the ones without a business owner, and require approval before an employee starts a remote session at someone else's request.
- Test recovery. Keep backups isolated and run a clean restore on a regular schedule so that restoration is a proven option during an incident.
- If you are a patient, employee or provider tied to Astrana: watch for an official notice once the company completes its review, and treat unsolicited calls that claim to come from the company with caution, verifying them through a number you look up yourself.
