Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines

Executive Summary

Astrana Health, Inc. (Nasdaq: ASTH), a California value-based healthcare company, disclosed a material cybersecurity incident under Item 1.05 of Form 8-K. Item 1.05 is the SEC's material-cybersecurity-incident item, not a voluntary Item 7.01 or 8.01 disclosure.¹² The filing gives September 22, 2026 as the date of report and the date the company determined the incident was material. EDGAR shows the 8-K was filed and accepted at 07:30:13 on September 23, 2026, and the chief executive signed it the same day.¹² The company does not give a detection date. It says only that it "recently became aware" that its subsidiary Astrana Health Management, Inc. had detected unusual activity in its environment.¹

The mechanism the company describes is voice-based social engineering. The threat actors impersonated company personnel and spoofed the company's main corporate telephone number, then contacted certain employees "in an effort to obtain unauthorized access to Company systems."¹ In its response the company reset affected credentials, restricted remote access tools, restored certain systems from clean backups, and expanded monitoring, logging and detection.¹ Based on its investigation so far, the company believes that "certain private and/or confidential information maintained on the Company's servers has been accessed and/or acquired without authorization." It is still working out whether patient, employee, credentialed provider, business, financial or intellectual-property information was involved.¹

Who the data might belong to matters here. Astrana Health Management (formerly Network Medical Management) is the wholly owned management services organization (MSO). It holds management services agreements with affiliated independent practice associations, including Allied Physicians of California.³ Astrana's segments run risk-bearing provider networks, hospital and clinic care delivery, and an MSO "Care Enablement" platform used by providers inside and outside its own network.³ In July 2025 the company added the Prospect Medical businesses for $674.9 million.³ Astrana reported coordinating care for about 1.6 million patients as of December 31, 2025, and about 1.5 million in August 2026.⁴⁵ These are the size of the patient population Astrana manages. Neither figure counts affected individuals, and no such count has been published.

The actor is unattributed as of October 2, 2026. The company has named no one, and no ransomware or extortion group appeared on the ransomware.live victim index when we checked on that date.¹⁶ SecurityWeek, The Record and GovInfoSecurity each reported finding no claim between September 23 and 25.⁷⁸⁹ Coverage moved beyond the filing in several places. Outlets reported that the calls "eventually" gave the attackers access, that data was "exfiltrated", that patient data was "exposed", and that the incident was material to Astrana's financial position. The 8-K says none of these things, and on the last point it says the opposite.¹⁷⁸¹⁰ This paper separates what the company disclosed from what was added downstream.

Verification of Claims

1. Claim: Astrana disclosed the incident under Item 1.05 (Material Cybersecurity Incidents), not as a voluntary Item 7.01 or 8.01 disclosure. → Verified → The 8-K is headed "Item 1.05 Material Cybersecurity Incident", and the EDGAR filing index lists the sole item as "Item 1.05: Material Cybersecurity Incidents".¹² A separate 8-K filed the same morning under Items 7.01 and 9.01 furnished an unrelated investor presentation.¹¹

2. Claim: The 8-K was filed on September 22, 2026 ("Tuesday evening"). → Unverified (contradicted by the EDGAR record) → September 22 is the date of report and the materiality date. EDGAR records a filing date of September 23, 2026, accepted at 07:30:13.² The Record reported a "Tuesday evening" filing, while GovInfoSecurity reported "a filing on Wednesday".⁸⁹

3. Claim: The threat actors impersonated Astrana personnel and spoofed the company's main corporate telephone number to contact employees. → Verified → This is the company's own description in its Item 1.05 filing.¹ No independent forensic report has been published, so the detail rests on the company's account alone.

4. Claim: The spoofed calls are how the attackers got into Astrana's systems and servers. → Partially verified → The 8-K says the incident "involved" the social engineering attempts, that unauthorized activity was detected, that affected credentials were reset, and that data on servers was accessed or acquired.¹ It never says in so many words that a call succeeded or how access was gained. SecurityWeek, The Record and HIPAA Journal state the causal link as fact, and HIPAA Journal attributes it to a "forensic investigation" the filing does not mention.⁷⁸¹⁰

5. Claim: The attackers used remote access tools inside the environment. → Unverified → This is only implied: "restricting remote access tools" appears among the remedial measures.¹ No tool is named, and the filing does not say any tool was abused.

6. Claim: Private or confidential information on Astrana's servers was accessed or acquired. → Verified → This is the company's stated belief "based on the current status" of its investigation.¹

7. Claim: The investigation determined that the attackers exfiltrated data. → Unverified → SecurityWeek wrote that Astrana told the SEC the actors "accessed and exfiltrated" information.⁷ The 8-K says "accessed and/or acquired", and lists exfiltration among the things the company "continues to assess".¹

8. Claim: The incident exposed patient, employee and provider information. → Unverified → This is HIPAA Journal's lead sentence.¹⁰ The 8-K says the company "continues to assess whether, and to what extent" those categories were involved. It does say it intends to notify "impacted patients" based on its findings.¹

9. Claim: The sensitivity of the data made the incident material to Astrana's financial position. → Unverified (contradicted by the filing) → This is The Record's reading.⁸ The 8-K bases materiality on "the potential confidential and sensitive nature of the data". In the same filing the company says it "currently does not expect that it will have a material effect on the Company's financial condition and results of operations."¹

10. Claim: No ransomware or extortion group has claimed the attack. → Verified (as of October 2, 2026) → A ransomware.live victim search for "astrana" returned no victims on October 2, 2026.⁶ SecurityWeek, The Record (as of Wednesday afternoon, September 23) and GovInfoSecurity (as of Friday, September 25) each reported seeing no claim.⁷⁸⁹ Absence from a tracker does not show that no group has the data.

11. Claim: Ransomware was involved. → Unverified → The company did not answer The Record's question on ransomware.⁸ Restoring "certain systems from clean backups" shows some systems were rebuilt. It does not show whether anything was encrypted.¹

Timeline

Attack Anatomy

What follows rebuilds the attack only as far as the 8-K allows. Each stage is marked Established (stated in the filing), Implied (inferred from the remedial measures), or Unknown.

Reconnaissance (Unknown)

The filing does not say how the actors chose which employees to call or how they learned enough about "Company personnel" to impersonate them.¹ The corporate number is not secret. Astrana's 8-K cover page lists a registrant telephone number of (626) 282-0288. The filing does not say whether that is the "main corporate telephone number" that was spoofed.¹

Initial contact: voice impersonation with caller-ID spoofing (Established)

The actors ran "a series of social engineering attempts". They impersonated Company personnel and spoofed the company's main corporate telephone number when contacting certain employees, "in an effort to obtain unauthorized access to Company systems."¹ A call that shows the company's own main number lends weight to an internal pretext such as IT support or a colleague. The filing does not give the pretext, the number of employees called, or which roles were targeted.¹ The closest ATT&CK fits are Social Engineering: Impersonation (T1684.001) and voice spearphishing for access (T1566.004). If the calls only harvested credentials, Phishing for Information: Spearphishing Voice (T1598.004) applies instead.

Access and foothold (Implied)

Two remedial measures point to the access route without confirming it. "Resetting affected credentials" suggests that account credentials were obtained or used (T1078, Valid Accounts). "Restricting remote access tools" suggests remote-access software was involved, either installed at a caller's direction or already present and misused (T1219, Remote Access Tools).¹ Both are inferences. The filing names no tool, no account type, and nothing about MFA.¹

Actions on objectives (Established in part)

The company believes "certain private and/or confidential information maintained on the Company's servers has been accessed and/or acquired without authorization."¹ It also "restor[ed] certain systems from clean backups", so at least some systems were judged untrustworthy and rebuilt. The filing does not say whether they were encrypted, altered or wiped.¹

Exfiltration (Unknown)

The company "continues to assess whether, and to what extent" information "may have been accessed, acquired, or exfiltrated."¹ No exfiltration channel, volume or destination has been disclosed.

Detection and response (Established)

Astrana's cybersecurity team detected and responded to the activity, began an investigation, and engaged an unnamed "leading third-party cybersecurity and digital forensics firm". It notified law enforcement and is notifying state and federal regulators and payer partners. It also enhanced monitoring, logging and detection.¹

Threat Actor Profile

Name: Unknown Aliases: None Attribution confidence: None. The incident is unattributed as of October 2, 2026. Astrana's 8-K refers only to "threat actors".¹ A ransomware.live victim search for "astrana" returned no victims on October 2, 2026.⁶ SecurityWeek, The Record and GovInfoSecurity each reported no claim of responsibility as of September 23–25.⁷⁸⁹ Motivation: Unknown. No ransom demand, leak-site listing or extortion contact has been disclosed, and the company did not tell The Record whether ransomware was involved.⁸ Sophistication: As far as the filing shows: an operator willing to make live phone calls, spoof caller ID, and pose convincingly as staff to several employees.¹

On comparisons to Scattered Spider or ShinyHunters. No source located for this paper links the Astrana incident to Scattered Spider, ShinyHunters, or any other named group. The FBI and CISA describe Scattered Spider as having "posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees", and as installing remote access tools.²³ That tradecraft looks like what Astrana describes. It is also widely shared across criminal groups, so the resemblance is an analogy and does not support attribution. No investigating body has made such a link.

MITRE ATT&CK techniques (IDs verified live on attack.mitre.org; mapping is ThreatPaper's, from the 8-K text):

OPSEC: Caller-ID spoofing of the company's own main number, so that inbound calls appeared to come from inside the organization.¹ Nothing else has been disclosed.

Technical Indicators

spoofed_caller_id:
  - "Astrana Health's main corporate telephone number (8-K does not state the digits)"
network_indicators: none disclosed
ip_addresses: none disclosed
domains: none disclosed
file_hashes: none disclosed
remote_access_tools: none named (8-K says only that remote access tools were restricted)
accounts: none disclosed (8-K says affected credentials were reset)
note: >
  The Item 1.05 Form 8-K is the only first-party account and publishes no
  indicators of compromise. No forensic report, government advisory or
  leak-site listing with indicators had been published as of 2 October 2026.
  The number on the 8-K cover page, (626) 282-0288, is the registrant's
  published business line, not an indicator, and the filing does not confirm
  it is the number that was spoofed.

Legal and Regulatory Response

SEC. Astrana filed under Item 1.05 of Form 8-K on September 23, 2026, one business day after its September 22 materiality determination.¹² The SEC's 2023 rules make an Item 1.05 report "generally due four business days after a registrant determines that a cybersecurity incident is material."²⁴ The company says it will amend the report as information required by Item 1.05(a) "is determined or becomes available."¹ No 8-K/A had been filed as of October 2, 2026.¹⁶

Health and state regulators. The company says it "is notifying state and federal regulators, and payer partners" and "intends to make all required notifications based on its findings, including to impacted patients."¹ As of October 2, 2026, the HHS Office for Civil Rights breach portal had no entry for Astrana or Astrana Health Management. Its most recent posted submission was dated September 16, 2026, which predates the disclosure.¹⁷ The California attorney general's list, updated through September 30, 2026, had no Astrana entry.¹⁸ The Texas attorney general's table showed no match among 640 entries.¹⁹ The Washington attorney general's list, latest entry September 11, 2026, had no Astrana entry, and a Vermont attorney general site search returned no results.²⁰²¹ Maine's public breach database was offline, so it could not be checked.²⁵

Law enforcement. The company says it notified law enforcement but does not name the agency.¹ No law enforcement statement, advisory or action tied to this incident had been published as of October 2, 2026.

Civil. The plaintiffs' firms Levi & Korsinsky and Scott+Scott announced investigations on September 23 and September 28, 2026.¹²¹⁴ ThreatPaper found no filed complaint in public web sources as of October 2, 2026. Court dockets were not searched directly.

Impact Assessment

• Confirmed: Private and/or confidential information on Astrana's servers was accessed and/or acquired without authorization, according to the company's investigation to date.¹
• Confirmed: Certain systems were restored from clean backups. Credentials were reset and remote access tools restricted.¹
• Confirmed: The company judged the incident material because of the potential sensitivity of the data. In the same filing it said it does not currently expect a material effect on its financial condition or results of operations.¹
• Reported, not independently confirmed: That the data includes patient, employee and provider information (HIPAA Journal's framing). The 8-K lists these as categories still under assessment.¹⁰¹
• Reported, not independently confirmed: That data was exfiltrated (SecurityWeek's framing). The 8-K says "accessed and/or acquired".⁷¹
• Estimated (context, not an affected count): The patient population Astrana manages is about 1.6 million as of December 31, 2025, per the 10-K, and about 1.5 million as of August 2026, per the Q2 release.⁴⁵ How many of these are affected is unknown.
• Unknown: The detection date, the dwell time, how many employees were called, whether any MFA was bypassed, and which remote access tool, if any, was used.¹⁹
• Unknown: The number of affected individuals and the data fields involved, and whether systems or data from the Prospect businesses acquired in 2025 are in scope.¹³
• Unknown: The identity of the actor, whether there was a ransom demand, and whether encryption occurred.⁸

Lessons and Defensive Recommendations

For SOC and help-desk teams:

• Do not treat caller ID as authentication. This incident shows the company's own main number can be spoofed for inbound calls to staff.¹ Any call asking for a credential, an MFA approval, a password reset or a remote session needs verification through a callback to a directory number or a ticket raised in a separate channel.
• Alert on new or unusual remote-access software sessions that start shortly after an inbound call or help-desk interaction. Restrict the tool set to an approved list, which is the control Astrana tightened after the fact.¹
• Correlate credential resets, new MFA device registrations and remote-session starts for the same user within a short window. That sequence is the shape of a vishing-driven takeover.

For IT and identity teams:

• Require phishing-resistant MFA for staff who can reach servers holding patient or provider data. Make MFA re-enrollment and password resets require a verified identity, not a phone call.
• At an MSO serving many affiliated IPAs, segment the data so that one compromised employee account does not reach every affiliate's records.³

For leadership:

• Astrana's own 10-K warned of "more sophisticated social engineering attacks" six months before this incident.⁴ Run voice-pretext exercises against real staff, including calls that spoof the company's own number, and measure the result.
• In an Item 1.05 filing, keep "accessed and/or acquired", "exfiltrated" and "material to the business" visibly separate. Coverage of this filing blurred each of them.⁷⁸¹⁰

For researchers and journalists:

• Quote the 8-K's verbs exactly. "In an effort to obtain unauthorized access" is not "gained access", and "accessed and/or acquired" is not "exfiltrated".¹
• A materiality determination under Item 1.05 can rest on the sensitivity of the data alone. Here the company said it is not expected to have a material financial effect.¹

Sources