In short
- Astrana Health, which runs a care platform used by about 20,000 US medical providers, told the SEC on September 23, 2026 that attackers had accessed confidential data on its servers.
- The attackers got in by phone: they impersonated Astrana staff and spoofed the company’s main number to talk employees into giving access.
- On October 9 the Chaos ransomware group listed Astrana on its leak site, claiming it published 1,500 GB including patient data and diagnoses. Astrana has not confirmed that claim.
- The lesson for any practice or small business: a call that shows your own company’s number can still be fake.
Astrana Health, a California company whose platform is used by about 20,000 medical providers across the United States, filed a report with the Securities and Exchange Commission on September 23, 2026, the day after it decided a cyberattack was material. The company said the attackers impersonated Astrana personnel and spoofed its main corporate phone number to contact employees, and used that to reach its servers. In its words, “certain private and/or confidential information maintained on the Company’s servers has been accessed and/or acquired without authorization.” Astrana has not said how many people are affected or what kind of data was taken.
On October 9, the Chaos ransomware group added Astrana to its leak site. Its post says the company “decided to pull out of the deal with us in order to save money” and claims that “the data and diagnoses of millions of patients” have been published, about 1,500 GB in total. That is the group’s own statement: Astrana has not confirmed it, and the size and content of the published files have not been independently verified.
What we know was affected
Astrana’s filing confirms unauthorized access to confidential information on its servers and says the investigation was still working out whether patient, employee, provider or business records were involved. The company reset affected credentials, restricted remote-access tools, restored some systems from clean backups, brought in outside forensics specialists, and notified law enforcement, regulators and payer partners. Individual notification letters would follow if the investigation finds they are required.
Does this touch your business?
If your practice, clinic or billing office works with Astrana or one of its affiliated medical groups, ask them directly whether your organization’s or your patients’ data was involved, and watch for an official notice. If you are a patient of a provider in the Astrana network, a breach notification letter may arrive later; treat any call or email about it with care until you can confirm it independently.
For everyone else, the way in matters more than the victim. This was not a technical exploit: someone called, the caller ID showed Astrana’s own number, and an employee was persuaded to help. We wrote about the same pattern of attackers who call instead of email; it works on a 10-person office as well as on a public company.
What to do this week
- Tell your team caller ID can be faked. A call that shows your company’s main number, or your IT provider’s, proves nothing. Nobody should give a password, a multi-factor code or remote access to a caller, whoever the caller says they are.
- Set a call-back rule. When someone asks for access or credentials by phone, hang up and call back on a number you already have, or ask the person face to face. Make this the rule, not a judgement call.
- Know who has remote access tools. List the remote-support tools installed on your computers and who can use them. Remove what is not needed; attackers who talk their way in usually ask the victim to install or approve one.
- If you work with Astrana, ask. Contact your Astrana or affiliated-group representative through a channel you already use, not through a number or link in an unexpected message.
Frequently asked questions
Did Chaos really publish Astrana patient data?
Chaos says it did, about 1,500 GB including diagnoses. As of October 12, 2026, Astrana had not confirmed it and the files had not been independently verified.
How did the attackers get in?
According to Astrana’s SEC filing, they impersonated Astrana personnel and spoofed the company’s main phone number to persuade employees to give them access.
Will patients be notified?
Astrana said it was notifying regulators and payer partners and would notify individuals if the investigation finds that is required.
How can I tell if a company I work with was hit by ransomware?
Search its name or domain in our free ransomware tracker, which shows leak-site claims with their dates.
Sources: The Record | Leak-site data from Ransomware.live | Written with AI assistance and checked against these sources on October 12, 2026