Hackers conducted a social engineering attack against Astrana Health by impersonating company personnel and spoofing the main phone number to contact employees. This allowed them to access the company's servers and exfiltrate private and confidential information. The breach involved the subsidiary Astrana Health Management and included data such as patient, employee, credentialed provider, confidential business, financial information, and intellectual property. Astrana Health detected the intrusion, engaged a third-party cybersecurity firm, notified authorities and partners, and took remediation steps including credential rotation, restricting remote access tools, rebuilding systems from clean backups, and improving monitoring and detection capabilities. The company continues to assess the full impact of the breach.

The breach resulted in unauthorized access and exfiltration of sensitive private and confidential information, potentially including patient data, employee information, credentialed provider details, confidential business and financial information, and intellectual property. While the incident is material due to the sensitivity of the data involved, Astrana Health does not expect it to impact its financial condition or operations. The threat actor has not been identified, and no ransomware or extortion claims have been reported.

Astrana Health has implemented remediation measures including rotating credentials, restricting remote access tools, rebuilding affected systems from clean backups, and enhancing monitoring, logging, and detection capabilities. The company engaged a third-party cybersecurity firm and notified relevant authorities and partners. Organizations should verify that similar social engineering attack vectors are mitigated by employee training and access controls. No additional urgent actions are indicated beyond the company's current response and ongoing investigation.