Dark Web Intelligence on X: " SECOND RANSOMWARE GROUP CLAIMS ASTRANA ...

X • October 25, 2026

Dark Web Intelligence @DailyDarkWeb 🇺🇸 🚨 SECOND RANSOMWARE GROUP CLAIMS ASTRANA HEALTH DATA A group calling itself "Falcon" has listed Astrana Health (NASDAQ: ASTH), the California physician-management and healthcare services company, on its leak site. The group claims a 738 GB extraction that it says includes internal documents and regulatory files. This is the second extortion claim against Astrana this month. The Chaos ransomware group listed the company on Oct 9, claiming 1,500 GB including patient data. Astrana disclosed a material cybersecurity incident to the SEC in September. It said attackers spoofed its main corporate phone number and impersonated staff to socially engineer access, and that some confidential information was accessed or taken. The company has not confirmed ransomware or either group's claims. ⚠️ Analyst Note: Two groups claiming one victim can mean data resale, an affiliate switching brands, or a recycled claim. Neither data volume has been verified. Patients, providers and payer partners should watch for Astrana-themed phishing and calls. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #Falcon #AstranaHealth #ASTH #Healthcare #DataLeak #ThreatIntelligence #CyberSecurity 3:12 PM · Oct 25, 2026 · 3,395 Views 2

PeritumAI @peritumAI 1h Two ransomware crews on the same health company in weeks. That's not a breach anymore, that's a timeshare.

Mohammad Vazin @mohammadvazin 2h Two groups listing the same victim often means one access broker sold the same foothold twice. For a physician-management firm, I'd check which vendor VPN or remote-support account was the way in, and how 738 GB left without tripping egress alerts.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Second Ransomware Group Targets Astrana Health in Major Data Breach The ransomware group 'Falcon' has claimed responsibility for a data breach at Astrana Health, announcing a 738 GB data extraction that includes sensitive internal documents and patient information. This incident marks the second ransomware claim against Astrana Health within a month, following a previous claim by the Chaos ransomware group on October 9, which alleged a 1,500 GB data breach. Astrana Health, a healthcare services company listed on NASDAQ (ASTH), previously reported a cybersecurity incident involving social engineering tactics that allowed attackers to spoof corporate communications. The company has not confirmed the ransomware claims or the extent of the data breach. Analysts suggest that the presence of two ransomware groups targeting the same company may indicate data resale or shared access. Stakeholders, including patients and partners, are advised to be vigilant against potential phishing attempts related to this incident. 3 sources 53

Extracted Entities

Dark Web Intelligence on X: " SECOND RANSOMWARE GROUP CLAIMS ASTRANA ...

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)