Astrana Health Says Social Engineering Attack Stole Information From Its Servers
Summary
Astrana Health told the SEC that attackers impersonated employees to access servers and exfiltrate information. The company is assessing what data was affected and says the incident is not expected to affect its finances or operations.
Key points
- Attackers impersonated Astrana Health personnel and spoofed the company’s main phone number to target employees.
- Astrana Health says threat actors accessed its servers and exfiltrated private and confidential information.
- The company is still assessing whether patient, employee, provider, business, financial, intellectual property, or other information was affected.
- Astrana Health engaged a cybersecurity firm, notified authorities and partners, and launched an investigation.
- Its response included rotating credentials, restricting remote access tools, rebuilding certain systems from clean backups, and improving monitoring, logging, and detection.
- The company described the incident as material because of the potentially sensitive data involved, but does not expect an impact on its financial condition or operations.
- The attacker has not been identified; SecurityWeek reported no known ransomware or extortion group had claimed responsibility.
Article Details
- Victim Organization
- Astrana Health Management, a subsidiary of Astrana Health
- Incident Type
- Social engineering attack involving impersonation and phone-number spoofing, unauthorized server access, and data exfiltration
- Data Types Exposed
- Private and confidential information was accessed and exfiltrated; the company was still assessing whether patient, employee, credentialed provider, confidential business and financial information, intellectual property, or other information was involved.
- Operational Impact
- Astrana Health said the incident was not expected to affect its financial condition or operations. The company rotated credentials, restricted remote access tools, rebuilt certain systems from clean backups, and improved monitoring, logging, and detection.
- Ransom Or Extortion
- No known ransomware or extortion group had claimed responsibility, according to the article.
- Claim Status
- confirmed