SecurityWeekpublished Sep 24, 09:56 UTC (2d ago)ingested Sep 24, 10:10 UTCby Ionut Arghire

Astrana Health Data Breach Impacts Private, Confidential Information

criticalData breachimportance 90

AI summary · glm-5.3

Astrana Health experienced a data breach due to a social engineering attack that exposed private and confidential information from its servers.

Astrana Health suffered a data breach after its servers were accessed via social engineering, exposing private and confidential information.

Read the original

OrganizationsAstrana Health Astrana Health Management

CountriesCalifornia

ATT&CK T1566.001 Spearphishing Attachment T1570.001 Phishing Attachment T1571.001 Spoofing Phone Number T1190 Exploit Public-Facing Application T1486 Data Encrypted for Impact

Tags#data-breach #data-exfiltration #healthcare #social-engineering

Full article302 words · extracted from securityweek.com · click to collapse

Astrana Health says private and confidential information was stolen from its servers after employees were targeted in a social engineering attack.

Astrana Health is a California-based physician-centric healthcare management company that provides back-office services, including claims and billing.

The incident involved the company’s subsidiary Astrana Health Management, according to a filing with the US Securities and Exchange Commission (SEC).

Hackers used social engineering to access the company’s servers, impersonating Astrana Health personnel and spoofing its main phone number to contact employees.

After detecting the attack, the company engaged a third-party cybersecurity firm, notified the relevant authorities and its partners, and launched an investigation.

In response to the intrusion, Astrana Health rotated credentials, restricted remote access tools, rebuilt certain systems from clean backups, and improved its monitoring, logging, and detection.

Advertisement. Scroll to continue reading.

The investigation has determined that the threat actors have accessed and exfiltrated certain private and confidential information from the company’s servers, Astrana Health told the SEC.

“The company continues to assess whether, and to what extent, patient, employee, credentialed provider, confidential business and financial information, intellectual property, or other information may have been accessed, acquired, or exfiltrated and continues to evaluate the potential impact of the unauthorized activity,” it said.

According to Astrana Health, the incident is material due to the “potential confidential and sensitive nature of the data that is involved”, but it is not expected to impact its financial condition and operations.

The company did not name the threat actor behind the attack, and SecurityWeek has not seen any known ransomware or extortion group claiming responsibility for the incident.