Astrana Health, a US healthcare management company, told the Securities and Exchange Commission on 23 September that private or confidential information on its servers had been accessed or taken without authorisation [1].
The attackers impersonated company staff and spoofed its main corporate phone number, calling employees to try to get into its systems [1].
The company determined on 22 September that the incident was material, "due to the potential confidential and sensitive nature of the data that is involved" [1].
What it covers
Astrana coordinated value-based care for about 1.6 million patients at the end of 2025, through a network of more than 20,000 contracted physicians [2].
It is still assessing whether patient, employee, provider, business or financial information was taken. It says it will notify affected patients as required [1].
It has reset credentials, restricted remote access tools, restored some systems from clean backups, and notified law enforcement and regulators [1].
What it does not tell you
How many people's data was accessed, or what kind. The filing gives no number [1].
What it will cost. The company says it cannot yet estimate the impact, but does not expect a material effect on its finances [1].
Comments