Healthcare Technology Company Astrana Discloses Cyberattack Following Social Engineering Incident
Astrana, a healthcare technology platform serving approximately 20,000 medical providers, disclosed a data breach in a filing with the Securities and Exchange Commission on Tuesday. Attackers spoofed the company's main telephone number and impersonated employees to gain server access. The company stated that confidential information was accessed without authorization and that the incident may affect its operations, financial condition and reputation. Astrana reported $972.5 million in revenue last quarter.
Attack Used Phone Number Spoofing and Employee Impersonation
The attackers called Astrana employees using a spoofed version of the company's corporate telephone number, according to the SEC filing. By impersonating Astrana personnel during these calls, the hackers convinced employees to take actions that eventually allowed unauthorized access to company servers.
Astrana's filing does not specify which employees were contacted, what information the attackers requested or how the access escalated. The company stated that it has notified law enforcement, federal and state regulators and customers. The filing does not say how many customers were impacted or what kind of information was taken.
Systems Restored From Backups
The company reported that it had to restore certain systems from clean backups as part of its response. Astrana did not respond to requests for comment about whether the incident involved ransomware.
As of Wednesday afternoon, no hacking group has publicly claimed responsibility for the attack.
Company Deems Incident Material to Financial Position
Astrana stated that the confidential and sensitive character of the data led the company to assess the breach as material to its financial position. The firm warned that the attack may impact its business strategy, operations, financial condition, relationships with providers and patients, and its reputation.
The company holds cyber insurance, but acknowledged in the filing that it is unclear whether coverage will be enough to make up the losses.
Healthcare Tech Sector Reports Multiple Breaches
The attack at Astrana marks another reported compromise in the healthcare technology sector. Electronic health records company Veradigm recently told the SEC about a data breach involving Social Security numbers.
Healthcare firms Nutex, AnMed, Aesto, Baylor Genetics, CareCloud, Paylogix and Boston Scientific have all reported cyberattacks over the last six months.
Steps to Reduce Social Engineering Risk
Organizations should review phone-based authentication procedures and train staff to verify caller identity through secondary channels before granting access or transferring sensitive information. Multi-factor authentication on all administrative systems reduces risk.
Regular testing of backup restoration processes reduces the operational impact of incidents that require system rebuilds.
- Train staff to verify caller identity through secondary channels before granting access or transferring information
- Implement multi-factor authentication on administrative systems
- Review phone-based authentication procedures
- Test backup restoration processes regularly
Investigation Continues
Astrana described its investigation as ongoing in the SEC filing. Based on the current status of the investigation, the company believes that certain private or confidential information maintained on the company's servers has been accessed or acquired without authorization.
The company did not provide a timeline for completing the forensic review or notifying all affected individuals.
Questions readers ask
How did hackers gain access to Astrana's servers?
Attackers spoofed Astrana's main corporate telephone number and impersonated company personnel in calls to employees. Through these calls, they eventually gained access to company servers. The filing does not specify which employees were contacted or what actions led to the access.
What type of data was exposed in the Astrana breach?
Astrana stated that certain private or confidential information maintained on its servers has been accessed or acquired without authorization. The company has not publicly disclosed the specific data categories or the number of affected individuals. The filing notes that the confidential and sensitive character of the data led the company to assess the incident as material to its financial position.
Was ransomware involved in the Astrana attack?
Astrana did not respond to requests for comment about whether the incident involved ransomware. The company reported restoring certain systems from clean backups. No hacking group has publicly claimed the attack as of Wednesday afternoon.
How can I tell if my data was affected by the Astrana breach?
Astrana stated that it is notifying affected customers, but the filing does not say how many customers were impacted. If you are a patient of a medical provider using Astrana's platform, monitor your mail for breach notification letters. Watch for unusual activity on credit reports and medical benefit statements.
Why do attackers target healthcare technology companies?
Healthcare technology companies hold large volumes of protected health information, billing records and provider credentials. Attackers seek access to these records, though the specific downstream use in any case depends on the attacker's goals and capabilities. The source does not state why this sector is targeted in the abstract.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.