Astrana Health discloses material cybersecurity incident; patient data may be affected
Astrana Health said social engineering attacks, in which threat actors impersonated company personnel and spoofed its main phone number, led to unauthorized activity in its environment. The company has determined the incident is material and believes certain private or confidential information was accessed or acquired, but the full scope remains under investigation. The company currently does not expect a material effect on its financial condition and results of operations, though it cannot yet estimate the full impact.
Key points
- Company determined the incident is material as of September 22, 2026, citing the potential confidential and sensitive nature of the data involved.
- Threat actors impersonated Company personnel and spoofed the main corporate telephone number to contact employees seeking unauthorized system access.
- Company engaged a third-party forensics firm, notified law enforcement, and is notifying state and federal regulators and payer partners.
- Company maintains cybersecurity insurance but says coverage may not be sufficient to cover all losses.
The filing
Written by AI (Anthropic Claude, claude-haiku-5-5) on Nov 8, 2026, 1:54 AM ET, from the text of the filing and its press-release exhibits only. Written later: this filing was briefed after the fact, when past filings were added to the site, so the brief may be read with hindsight; the filing itself is the record of what was known on September 23, 2026.
Briefs are written by AI from the filing text (each brief's own page names the model) and can contain mistakes — open the filing before acting on anything. Impact (1-5) and tone are the model's reading of the filing for shareholders, not a price forecast. Not investment advice.