Hackers used spoofed calls to get into Astrana Health's servers

Assessment

SecurityWeek wrote that hackers "used social engineering to access the company's servers." The Record said the callers "eventually were able to gain access to company servers," and HIPAA Journal said a "forensic investigation found" employees were tricked into providing access. Astrana's Item 1.05 8-K says less than any of these. It says the incident "involved a series of social engineering attempts" made "in an effort to obtain unauthorized access," that unauthorized activity was detected, that affected credentials were reset, and that data on servers was accessed and/or acquired. It never states that a call succeeded, how access was gained, or what a forensic investigation found. The causal link is a reasonable inference from how the filing is arranged, but it is circumstantial and should not be repeated as the company's finding.