Back Securityweek

Astrana Health Data Breach Impacts Private, Confidential Information

Securityweek • September 24, 2026

Astrana Health says private and confidential information was stolen from its servers after employees were targeted in a social engineering attack.

Astrana Health is a California-based physician-centric healthcare management company that provides back-office services, including claims and billing.

The incident involved the company’s subsidiary Astrana Health Management, according to a filing with the US Securities and Exchange Commission (SEC).

Hackers used social engineering to access the company’s servers, impersonating Astrana Health personnel and spoofing its main phone number to employees.

After detecting the attack, the company engaged a third-party cybersecurity firm, notified the relevant authorities and its partners, and launched an investigation.

In response to the intrusion, Astrana Health rotated credentials, restricted remote access tools, rebuilt certain systems from clean backups, and improved its monitoring, logging, and detection.

The investigation has determined that the threat actors have accessed and exfiltrated certain private and confidential information from the company’s servers, Astrana Health told the SEC.

“The company continues to assess whether, and to what extent, patient, employee, credentialed provider, confidential business and financial information, intellectual property, or other information may have been accessed, acquired, or exfiltrated and continues to evaluate the potential impact of the unauthorized activity,” it said.

According to Astrana Health, the incident is material due to the “potential confidential and sensitive nature of the data that is involved”, but it is not expected to impact its financial condition and operations.

The company did not name the threat actor behind the attack, and SecurityWeek has not seen any known ransomware or extortion group claiming responsibility for the incident.

Related: ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report

Related: BigCommerce Data Stolen via Ribon Apps Hack

Related: CrowdSec Confirms Source Code Stolen in Supply Chain Attack

Related: 280,000 Impacted by Premier Medical Group Data Breach

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Astrana Health Data Breach Exposes Confidential Information Astrana Health reported a data breach involving its subsidiary, Astrana Health Management, due to social engineering attacks targeting employees. The attackers impersonated company personnel and spoofed the corporate phone number to gain unauthorized access to company systems. Preliminary investigations indicate that private and confidential information may have been accessed and exfiltrated from the company's servers. Astrana Health engaged third-party cybersecurity experts and notified relevant authorities while launching an internal investigation. The company is assessing the extent of the data accessed, which could include patient, employee, and business information. Astrana Health has implemented security measures such as credential rotation and system rebuilding from clean backups. The investigation is ongoing, and notifications will be made to affected individuals once the scope is fully determined. 5 sources 52

Extracted Entities

Astrana Health Data Breach Impacts Private, Confidential Information

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Industries (1)