Breaches and incidents
Astrana Health: phone-spoofing social engineering leads to material breach
Astrana’s 8-K (date of report 22 Sep 2026, signed 23 Sep) says subsidiary Astrana Health Management detected unusual activity.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Astrana’s 8-K (date of report 22 Sep 2026, signed 23 Sep) says subsidiary Astrana Health Management detected unusual activity; threat actors impersonating staff and “spoofing the Company’s main corporate telephone number” contacted employees, and “certain private and/or confidential information” on its servers was accessed. HIPAA Journal says the data under review covers patient, employee, credentialed provider and business information.
- Root cause: voice social engineering with caller ID spoofing to obtain system access.
- No attacker named; HIPAA Journal says no group has claimed it.
- Astrana reset credentials, restricted remote access tools, restored systems from clean backups, notified law enforcement and regulators, and found the incident material as of 22 Sep 2026.