Loading story…
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected.
Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Astrana disclosed the cyberattack in a report filed with the U.S. Securities and Exchange Commission, describing the incident as material due to the potentially confidential and sensitive information involved. The company had not identified the responsible threat actor or confirmed ransomware involvement.
Astrana engaged a third-party cybersecurity firm, rotated credentials, restricted remote-access tools, rebuilt affected systems from clean backups, and enhanced monitoring and detection. The company also notified law enforcement, relevant regulators or authorities, customers, and partners.
Attackers impersonated Astrana personnel and spoofed the company’s main telephone number to socially engineer employees and gain access to company servers. Astrana confirmed that private and confidential information was accessed and exfiltrated, while it continued assessing the categories of affected data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026
iRhythm Holdings disclosed a material cybersecurity incident after attackers used social engineering to access certain third-party-hosted business applications and exfiltrate sensitive data. According to the company’s SEC filing, unauthorized activity was identified on June 8, and on June 9 a threat actor contacted iRhythm claiming to possess proprietary company information, patient **protected health information**, and other personal data, while demanding payment to stop the information from being publicly released. The company said the intrusion was confined to third-party business applications and that there is no evidence its products, clinical or medical device systems, customer connections, patient safety, manufacturing and distribution operations, or financial reporting systems were affected. iRhythm has not named a responsible group or disclosed how many individuals were impacted, and said it is still investigating with external cybersecurity experts whether the attacker’s claims fully match the data stolen; it also stated that payment card and financial account information were not involved and that it has not found evidence of ongoing unauthorized access.
Jun 29, 2026
Aesto Health, a US healthcare data migration and archiving provider, disclosed that an unauthorized actor accessed a limited portion of its Amazon Web Services environment and may have acquired personal information and protected health information for **9,540,683 individuals**. The activity occurred between December 2 and December 18, 2025; the company detected unauthorized activity on December 18 and concluded following forensic investigation and document review on May 26, 2026, that data had been exfiltrated during that period. The breach affects data supplied by at least two dozen healthcare-provider clients across multiple US states, some of which have issued their own notifications to potentially affected patients. Aesto said it notified impacted provider customers and reported the incident to the US Department of Health and Human Services, but it has not identified the threat actor, entry method, affected AWS resource, or volume of stolen data. The company said it has no evidence so far of resulting identity theft or financial fraud.
Sep 4, 2026