Astrana Health, a California-based physician support and healthcare technology company, has disclosed a cybersecurity incident affecting its subsidiary Astrana Health Management, which handles the company’s administration and management services.
Companies that provide administrative and technology support to physician networks are entrusted with sensitive patient, provider, and business information, and they carry a responsibility to keep that information secure from unauthorized access.
Astrana Health’s Data Breach Investigation
According to a Form 8-K filed with the U.S. Securities and Exchange Commission on September 22, 2026, Astrana Health became aware that its subsidiary detected unusual activity within its computer environment. The filing describes the incident as a series of social engineering attempts, in which threat actors deceived certain employees by impersonating company personnel and spoofing the company’s own corporate phone number in an effort to gain unauthorized access to internal systems.
Social engineering attacks like this one rely on manipulating employees directly, rather than exploiting a technical vulnerability in software or hardware. By impersonating trusted colleagues or IT staff and using a spoofed phone number to appear legitimate, attackers can convince employees to hand over credentials or grant access that a purely technical attack would have to work much harder to obtain. This method has become increasingly common against healthcare and healthcare-adjacent companies, since employees at large organizations with many departments and vendors may be less likely to question a call or message that appears to come from an internal number.
Astrana Health has stated that it engaged third-party cybersecurity and digital forensics experts to investigate the incident, and that it has notified law enforcement, regulators, and its payer partners. The company reported taking a number of remedial steps, including resetting credentials, restricting remote access, restoring systems from clean backups, and enhancing ongoing monitoring of its network.
Preliminary findings described in the SEC filing suggest that unauthorized parties accessed some private or confidential information stored on Astrana Health’s servers, though the company states that its investigation is still underway to determine whether, and to what extent, patient, employee, credentialed provider, or other business information was accessed, acquired, or removed from its systems. Given Astrana Health’s role supporting physician networks and independent practice associations, a breach here has the potential to affect not only the company’s own employees but also patients and providers connected through its affiliated medical groups.
When Did This Breach Occur?
Astrana Health’s SEC filing states that the incident was deemed material as of September 22, 2026, with the disclosure filed on September 23, 2026. The company has not yet disclosed the specific date the underlying unauthorized access first began.
What Information Was Breached?
Astrana Health has not yet disclosed a specific list of the data categories involved in this incident. The company states that its investigation is ongoing to determine whether patient information, employee information, credentialed provider information, or other business information was accessed or acquired, and that it will make notifications to affected individuals once that assessment is complete.
What You Can Do
If you are a patient, employee, or credentialed provider affiliated with Astrana Health or one of its affiliated medical groups, consider taking the following steps while the investigation continues:
- Watch for an official notification letter from Astrana Health describing what information was involved in your case
- Be cautious of phone calls or messages claiming to be from Astrana Health, especially any requesting personal information or login credentials
- Review your financial and insurance statements for unfamiliar activity
- Enroll in any credit monitoring or identity protection services Astrana Health may offer once notifications go out
- Keep any correspondence related to this incident for your records
File a Data Breach Lawsuit Against Astrana Health
If your personal information was exposed as a result of this breach, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
