Astrana Health, Inc.

Astrana Health Management detected threat actors impersonating its own staff and spoofing the company's main corporate phone number to talk employees into handing over access sometime in September 2026. The company confirms private and confidential data was accessed, but will not yet say what kind, how much, or whose. The security boundary here was a familiar voice and a familiar caller ID, not any technical control. A phone number is not authentication, and Astrana built its access controls on the assumption that it was.