Astrana Health discloses a material cyber incident in which attackers impersonated its staff and confidential data was accessed
SEC filings show the healthcare company declared the incident material on 22 September 2026 and has notified law enforcement and regulators.
Drafted by the Loro Desk from public records and published automatically after a 24-hour hold. Published without editorial review.
Astrana Health has disclosed a material cybersecurity incident in which attackers impersonated staff and confidential information, potentially including patient, employee and provider data, was accessed; it does not currently expect a material financial effect.
- Company
- Astrana Health, Inc., CIK 0001083446
- Declared material
- 22 September 2026
- Method
- Social engineering; spoofed corporate phone number
- Data potentially involved
- Patient, employee, provider, business and financial
- Law enforcement notified
- Yes
Astrana Health, Inc. (SEC CIK 0001083446) has disclosed a material cybersecurity incident at its subsidiary Astrana Health Management, Inc., after identifying unusual activity within its environment. (Form 8-K, filed 23 September 2026, Item 1.05)
According to the filing, threat actors impersonated company personnel, spoofed the company's main corporate telephone number and contacted certain employees in an attempt to gain unauthorised access to its systems. (Form 8-K, 23 September 2026)
The company says it determined that certain private or confidential information on its servers was accessed or acquired without authorisation. The information potentially involved includes patient, employee and credentialed provider data, as well as confidential business and financial information and intellectual property. (Form 8-K, 23 September 2026)
The company determined on 22 September 2026 that the incident was material, citing the potential confidential and sensitive nature of the data involved. (Form 8-K, 23 September 2026)
Its response, as described in the filing, included resetting affected credentials, restricting remote access tools, restoring certain systems from clean backups and enhancing monitoring. It engaged a third-party cybersecurity and forensics firm, notified law enforcement, and is notifying state and federal regulators and payer partners. (Form 8-K, 23 September 2026)
The company says it does not currently expect the incident to have a material effect on its financial condition or results of operations, while stating that it cannot yet estimate the full impact. It notes that cybersecurity insurance may provide coverage. (Form 8-K, 23 September 2026)
The filings do not state when the activity was first detected or how many patients or employees are affected. Loro has made no approach to the company. Figures are as reported in Astrana Health's SEC filings.
Primary sources
1 recordEvery factual claim above is drawn from these records. Each link resolves to the publisher’s own copy.