On October 9, 2026, the Chaos ransomware group added Astrana Health, Inc. (Nasdaq: ASTH) to its leak site. The group says it stole 1,500 GB of data and has published "the data and diagnoses of millions of patients." That claim is not verified. Astrana has not linked Chaos to any incident or confirmed the volume or contents of the data. It has, however, confirmed a breach. In a Form 8-K filed with the SEC on September 23, 2026, the company said attackers used social engineering to break into its servers and took "certain private and confidential information." Anyone assessing this claim should start from that filing.
What Happened
The company's own account comes first. Its 8-K reports a cybersecurity incident under Item 1.05, with September 22, 2026 as the date of the earliest event reported. SecurityWeek covered the filing. It says the intrusion affected the subsidiary Astrana Health Management. After detecting it, Astrana brought in a third-party cybersecurity firm, notified authorities and partners, and opened an investigation. The company called the incident material because of the "potential confidential and sensitive nature of the data," but said it did not expect it to affect its financial condition or operations. The filing did not name a threat actor. As of September 24, SecurityWeek said it had not seen any ransomware or extortion group claim the attack.
The leak-site claim came about two weeks later. Breach House, HackerFeeds and Today In Cyber (via Ransomware Live) all date the Chaos listing to October 9, 2026. RecentBreaches dates it to October 10, which may just reflect when that site indexed it. In its post, Chaos says Astrana's management "decided to pull out of the deal with us in order to save money." If that is true, there were negotiations that broke down. Breach House lists the leak status as "leaked," and Today In Cyber says the full dataset has been published. Neither has confirmed what the files actually contain.
The sources disagree in two places. RecentBreaches says Astrana "has not publicly confirmed that an incident occurred." The SEC filing shows that is wrong: the company disclosed an intrusion and data exfiltration in September. What remains unconfirmed is narrower. Astrana has not said whether Chaos was behind the September intrusion, and it has not confirmed the 1.5 TB figure or the "millions of patients" claim. QPulse says the attack happened on the same day as the October 9 listing. That conflicts with the company's September timeline and most likely confuses the posting date with the intrusion date.
What Was Taken
The 1,500 GB figure and the description of patient diagnoses for "millions of patients" come only from Chaos. Every secondary source repeats them from the leak post. No independent outlet or regulator has confirmed either the volume or the number of people affected. RecentBreaches notes that the data types are "not itemised."
Astrana's own position, as of its filing, is that attackers exfiltrated "certain private and confidential information." The company said it was still assessing whether patient, employee, credentialed provider, confidential business and financial information, intellectual property, or other data had been accessed or taken. As of this writing, no count of affected individuals has been filed with HHS or with state attorneys general.
Two sources also report infostealer exposure linked to astranahealth.com, and their numbers differ. QPulse reports 49 compromised users, 260 passwords, 59 cookies and seven exposed credential URLs. Breach House, citing HaveIBeenRansom, reports 25 hits in infostealer logs. Both are OTHER-tier sources, they may be measuring different things, and neither shows a connection to this intrusion. Treat this as background risk, not as a proven way in.
Why It Matters
Astrana provides back-office services for physician groups, including claims and billing. Companies in that position typically hold clinical and payment data covering large numbers of patients and many provider practices. If the Chaos claim holds up, it would be a major protected health information (PHI) exposure, with HIPAA breach notification obligations and knock-on risk for downstream providers.
The incident also shows a pattern defenders should expect. A company discloses a breach without naming the actor. Negotiations fail. The data then appears on a leak site weeks later. If a victim's filing describes exfiltration, assume publication may follow, and have notification and fraud monitoring ready before a leak post appears.
This group should not be confused with the older "Chaos" ransomware builder from 2021. The current Chaos operation appeared in 2025, and public reporting from Cisco Talos has associated it with voice phishing and abuse of remote-management tools. That is consistent with what Astrana described. The match supports Chaos's claim of responsibility but does not prove it.
The Attack Technique
According to Astrana's SEC filing as reported by SecurityWeek, the attackers impersonated Astrana personnel and spoofed the company's main phone number to call employees. That is vishing. They used those calls to get access to company servers. The company's remediation steps indicate what was involved: it rotated credentials, restricted remote access tools, rebuilt certain systems from clean backups, and improved monitoring, logging and detection. Restricting remote access tools suggests that legitimate remote-support or remote monitoring and management (RMM) software was used to get or keep access. The company has not said which tool, and that remains an inference.
QPulse suggests that infostealer activity before the attack may have contributed to initial access. Nothing in the primary filing supports that, and it should be treated as speculation.
What Organizations Should Do
- Make help-desk and employee calls verifiable. Caller ID alone should never count as proof of identity, because spoofed internal numbers are exactly what was used here. Require callback to a directory-listed number or a ticket reference before anyone acts on a request.
- Lock down remote access tools. Allowlist one approved RMM or remote-support product, block Quick Assist and unapproved remote tools where the business does not need them, and alert on any new remote session that does not have a matching ticket.
- Hunt for infostealer exposure. Check for corporate credentials and session cookies in stealer logs, force password resets, and revoke active sessions and tokens for any accounts found. Rotating passwords does not invalidate stolen cookies.
- Watch for large outbound transfers. A 1.5 TB exfiltration, if real, means sustained egress. Baseline outbound volume from file servers and EHR and claims systems, and alert on unusual transfers to cloud storage or unfamiliar hosts.
- Assume a leak may follow any disclosure. If you have filed an exfiltration disclosure, prepare patient and partner notifications, credit and identity monitoring, and leak-site monitoring now. Do not wait for the actor to post.
- Business associates and partners of Astrana: ask for written confirmation of whether your data was in scope, and review shared credentials and integrations with Astrana systems.
Sources: Chaos Ransomware Group Exfiltrates 1500 GB of Data from Astrana Hea... | Astrana Health, Inc. Form 8-K filed September 23, 2026 | Astrana Health Data Breach Impacts Private, Confidential Informatio... | astranahealth.com Ransomware Claim (2026) — What’s Alleged & Am I A... | Form 8-K - Current report | astranahealth.com — CHAOS Ransomware Attack Breach House | Ransomware group chaos hits astranahealth.com HackerFeeds | 🏴☠️ Chaos has just published a new victim : astranahealth.com Tod...