Astrana Health, Inc. disclosed a material cybersecurity incident in a Form 8-K filed with the U.S. Securities and Exchange Commission on September 23, 2026. The company said its subsidiary, Astrana Health Management, Inc., detected unusual activity after threat actors used social engineering attempts, impersonated company personnel, and spoofed the company's corporate telephone number to contact employees. Astrana said it notified law enforcement, regulators, payer partners, and engaged a cybersecurity and digital forensics firm.
Astrana reported that unauthorized parties may have accessed or acquired private or confidential information stored on its servers. The company is assessing whether patient, employee, credentialed provider, confidential business, financial, intellectual property, or other information was accessed, acquired, or exfiltrated. No affected-individual count or specific confirmed data elements, such as Social Security numbers or medical records, has been disclosed, and consumer notifications had not yet been reported. The investigation remained ongoing as of the disclosure, so further details may emerge and required notices may be issued later.