Astrana told the SEC attackers accessed and exfiltrated its data

Assessment

SecurityWeek reported that "the investigation has determined that the threat actors have accessed and exfiltrated certain private and confidential information," attributing this to what Astrana told the SEC. The 8-K's words are "accessed and/or acquired without authorization." It lists exfiltration among the open questions: the company "continues to assess whether, and to what extent" information "may have been accessed, acquired, or exfiltrated." "Acquired" can mean data was taken, so exfiltration is possible, but the company has not said it determined exfiltration. Repeating the claim as a company finding overstates the filing.