Skip to content
Second Ransomware Group Targets Astrana Health in Major Data Breach

Second Ransomware Group Targets Astrana Health in Major Data Breach

First seen 25 Oct 2026, 18:12 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 19:12 UTC

The ransomware group 'Falcon' has claimed responsibility for a data breach at Astrana Health, announcing a 738 GB data extraction that includes sensitive internal documents and patient information. This incident marks the second ransomware claim against Astrana Health within a month, following a previous claim by the Chaos ransomware group on October 9, which alleged a 1,500 GB data breach. Astrana Health, a healthcare services company listed on NASDAQ (ASTH), previously reported a cybersecurity incident involving social engineering tactics that allowed attackers to spoof corporate communications. The company has not confirmed the ransomware claims or the extent of the data breach. Analysts suggest that the presence of two ransomware groups targeting the same company may indicate data resale or shared access. Stakeholders, including patients and partners, are advised to be vigilant against potential phishing attempts related to this incident.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-09
Chaos ransomware group claims breach
Chaos announced a 1,500 GB data breach of Astrana Health, including patient data.
Dark Web Intelligence
2026-10-25
Falcon claims new breach of Astrana Health
Falcon announced a 738 GB data extraction from Astrana Health, detailing various internal documents.
Ransomware.Live

More articles in this cluster (3)

Following this threat?

Track Chaos and Astrana Health in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What data has been claimed as stolen?
Falcon claims to have extracted internal documents, regulatory files, and sensitive patient information.
How should we respond to this incident?
Stay alert for phishing attempts related to Astrana Health and monitor communications for any suspicious activity.
Is there confirmation of the breach?
No, Astrana Health has not confirmed the ransomware claims or the extent of the data breach.