Astrana Health has confirmed in its latest quarterly filing that attackers gained unauthorised access to private and confidential information on its servers, after a social-engineering campaign targeted its staff. The healthcare company, listed on Nasdaq under the ticker ASTH, filed its Form 10-Q for the quarter ending 30 September 2026 on 6 November 2026.

According to the filing, the incident began at Astrana Health Management, a subsidiary, where unusual activity was detected. Attackers impersonated company personnel and spoofed the firm's main corporate telephone number, then contacted employees in an effort to obtain access to company systems. The company says it believes certain private and confidential information held on its servers was accessed or acquired without authorisation.

Astrana reported the incident to the US Securities and Exchange Commission in a Form 8-K filed on 23 September 2026, having determined the day before that the incident was material because of the potentially sensitive nature of the data involved. It has engaged a third-party cybersecurity and digital forensics firm, notified law enforcement and regulators, and informed payer partners.

Remedial steps taken so far include resetting affected credentials, restricting remote-access tools, restoring some systems from clean backups, and strengthening monitoring, logging and detection across its environment. The company is still assessing whether patient, employee or credentialed-provider information, confidential business and financial records, or intellectual property were affected, and it has not disclosed how many people are involved.

No ransomware group has claimed responsibility, and the filing gives no figure for the number of people affected. The company has said it does not expect the incident to have a significant effect on its financial position or operations, while the investigation continues.