Astrana Health, Inc. — Form 8-K Summary
Business Context and Reporting Period
Astrana Health, Inc. filed a Form 8-K under Item 1.05 on September 22, 2026, regarding a material cybersecurity incident involving its subsidiary, Astrana Health Management, Inc. The report was signed on September 23, 2026.
Financial Metrics and Liquidity
The filing does not provide revenue, profit, cash flow, margin, debt, liquidity, or other quantitative financial metrics. The Company currently does not expect the incident to have a material effect on its financial condition or results of operations, but stated that it cannot yet estimate the full potential impact, including remediation, legal, regulatory, notification, and other response costs.
Material Changes and Cybersecurity Incident
- Threat actors used social engineering, impersonated Company personnel, and spoofed the Company’s main corporate telephone number to seek unauthorized access to Company systems.
- The Company detected and responded to the activity, engaged a third-party cybersecurity and digital forensics firm, notified law enforcement, and is notifying regulators and payer partners.
- Remedial actions included resetting affected credentials, restricting remote-access tools, restoring certain systems from clean backups, and enhancing monitoring, logging, and detection capabilities.
- The investigation remains ongoing. The Company believes certain private or confidential information on its servers was accessed or acquired without authorization.
- The Company has not determined whether, or to what extent, patient, employee, provider, business, financial, intellectual-property, or other information was accessed, acquired, or exfiltrated.
Outlook, Risks, and Unusual Items
The Company considers the incident material as of September 22, 2026, because of the potentially confidential and sensitive nature of the data involved. It is evaluating legal and regulatory notification requirements and expects to make required notifications, including to impacted patients if applicable.
Potential effects include operational disruption, remediation and response costs, litigation, regulatory scrutiny, notification expenses, reputational harm, effects on relationships with providers, patients, payers and other counterparties, management distraction, and possible effects on the Company’s stock price. Cybersecurity insurance may cover some losses, but the Company cannot assure that coverage will be sufficient.
No specific financial guidance or revised outlook was provided. The Company stated that it will amend the filing if information required under Item 1.05 becomes available or is determined.
Important Facts for Investors to Verify
- The scope and type of information accessed, acquired, or exfiltrated.
- Whether patient, employee, provider, or third-party data was compromised and the number of affected individuals.
- Whether the incident caused operational disruption or data loss.
- The amount and timing of remediation, legal, regulatory, notification, and other related costs.
- The availability and adequacy of cybersecurity insurance coverage.
- Any required amendments to the Form 8-K, regulatory inquiries, litigation, or additional patient and stakeholder notifications.
- Whether the incident ultimately affects financial results, reputation, payer and provider relationships, or the Company’s stock price.