The Falcon ransomware group has put Astrana Health (NASDAQ: ASTH) on its leak site. It says it stole 738 GB of internal data from the California-based healthcare management company. The claim has not been verified. Astrana has not confirmed that Falcon was involved, and the only sources reporting the listing are threat-intel aggregators: QPulse, Undercode News and Breach House. What is confirmed is an earlier breach. In its own Form 8-K filed with the SEC on September 23, 2026, Astrana disclosed a material cybersecurity incident. Attackers used social engineering and exfiltrated "certain private and/or confidential information" from its servers. Falcon is also the second group to name Astrana. Undercode News reports that the Chaos ransomware group listed the company on October 9 and claimed about 1,500 GB. It is not clear whether either listing relates to the September breach.
What Happened
The confirmed incident. The 8-K says Astrana's subsidiary, Astrana Health Management, detected unusual activity in its IT environment. The company determined on September 22, 2026 that the incident was material. Attackers posed as Astrana staff, spoofed the company's main phone number and called employees, which got them access to company servers (SecurityWeek, HIPAA Journal, The Record). Astrana brought in a third-party forensics firm and notified law enforcement, regulators and payer partners. In response it: - reset affected credentials - restricted remote access tools - restored certain systems from clean backups - improved monitoring
Restoring from clean backups suggests systems were damaged or encrypted. When The Record asked whether ransomware was involved, Astrana did not respond.
When the filing went out, no group had claimed the attack. SecurityWeek, HIPAA Journal and The Record all said so.
The extortion claims. - Chaos, October 9: Undercode News reports that Chaos listed Astrana and claimed about 1,500 GB, including patient information. No other source here confirms this. - Falcon, October 25: Falcon's listing appeared at 14:53 UTC, according to QPulse. QPulse also says Falcon claims Astrana contacted the group, describes that contact as "timewasted," and promises "re-attacks."
Breach House lists the victim as having 51 to 100 employees. That conflicts with The Record's figure of $972.5 million in quarterly revenue from about 20,000 providers, so treat the aggregator's metadata with caution.
Where the accounts differ. The sources don't agree on how much the incident matters financially: - SecurityWeek and the StockTitan summary of the 8-K say Astrana does not currently expect a material effect on its financial condition or results. - HIPAA Journal and The Record stress that Astrana could not estimate the full impact, and that it warned of possible effects on operations, providers, patients and reputation.
Both readings come from the same filing. Astrana considers the incident material because of how sensitive the data is, not because of current financial harm.
What Was Taken
Confirmed by Astrana: some private and/or confidential information was accessed and/or acquired. The company is still working out whether patient, employee, credentialed provider, business, financial or intellectual property data was involved. It has not given any record count or data volume. HIPAA Journal's headline says patient, employee and provider data was "exposed." The filing itself only says those categories are under review.
Claimed by Falcon (unverified, per QPulse): - 738 GB of data, including: - regulatory audit reports and regulatory notifications - payer financial dispute trackers and reimbursement tables - acquisition pipelines and operational readiness reviews - funds transfer records and company financial statements - user credential lists, client contact lists and employee PII
Claimed by Chaos (unverified, per Undercode News): about 1,500 GB, including patient information.
Reported volumes therefore run from 738 GB (Falcon's claim) to 1,500 GB (Chaos's claim). Neither has been verified, and they may or may not overlap. None of these sources confirms that patient PHI was in either set. PHI exposure is plausible, because Astrana handles claims and billing and is reviewing patient data. But for now it is unproven.
Why It Matters
- Two groups, one victim. There are several possible explanations: access shared or resold between affiliates, a second intrusion (which would match Falcon's "re-attack" threat), a recycled or duplicated dataset, or a false claim aimed at a company already known to be breached. Each one carries a different risk for Astrana's partners.
- Downstream exposure. About 20,000 providers depend on Astrana for claims, billing and payer operations. Leaked reimbursement tables, payer dispute records or credential lists could lead to fraud or follow-on phishing against those providers.
- Regulatory clock. If the review confirms patient PHI was involved, HIPAA breach notification obligations apply on top of the SEC disclosure already filed.
- The tactic works. Using a spoofed corporate phone number to call staff while posing as colleagues defeats controls built around email. Healthcare service providers have been repeatedly hit this way.
The Attack Technique
Astrana's 8-K, as reported by SecurityWeek, HIPAA Journal and The Record, describes vishing (voice phishing) with caller ID spoofing:
- Attackers spoofed Astrana's main corporate phone number.
- They called employees while posing as company personnel.
- They talked employees into granting access to company systems.
The steps Astrana took afterwards suggest how the attackers used that access: restricting remote access tools points to abuse of remote monitoring and management (RMM) or remote desktop software, and rotating credentials points to harvested logins. Astrana has not named an actor. None of the sources ties Falcon's or Chaos's tooling to this intrusion.
What Organizations Should Do
- Never trust caller ID. Train staff that a call from the company's own number proves nothing. Before acting on any request for access, a password reset or MFA enrollment, call the person back on a number from the internal directory.
- Lock down remote access tools. Allowlist approved RMM and remote desktop software, block unapproved installs, and alert when a new remote session tool appears on an endpoint.
- Harden help desk identity checks. For password and MFA resets, require phishing-resistant proof of identity, such as a manager approval or an in-person or video check.
- Partners of Astrana: assume the credentials and contact lists Falcon claims to hold could be used against you. Rotate any shared credentials, and warn finance and billing teams about payment redirection and impersonation attempts.
- Healthcare entities generally: keep offline, immutable backups and test restores. Astrana's recovery from clean backups shows this pays off.
- Watch the leak sites. Track the Falcon and Chaos listings for published samples. If data is posted, it is the fastest way to confirm what was taken and whether it includes PHI.
Sources: Falcon Ransomware Group Claims Exfiltration of 738 GB of Data from... | Astrana Health Data Breach Impacts Private, Confidential Informatio... | Astrana Health Notifies SEC About Social Engineering Incident | Astrana latest healthcare tech firm to report data breach to SEC T... | Astrana Health Faces Second Ransomware Extortion Claim as Falcon Al... | Astrana Health — FALCON Ransomware Attack Breach House | September 23, 2026 - 8-K: Current report Astrana Health, Inc. (ASTH) | Astrana Health reports material cyber incident ASTH 8-K Filing