What Is This About?

Astrana Health Management, Inc., a subsidiary of publicly traded Astrana Health, Inc. (collectively, “Astrana”) reported a data breach to the U.S. Securities and Exchange Commission (“SEC”) in a Form 8-K filed September 23, 2026. Our firm is investigating this incident and would like to speak with people who are current or former patients of a provider who uses Astrana’s management services, such as providers associated with Allied Pacific of California IPA.

What Happened?

On September 23, 2026, Astrana filed a Form 8-K with the SEC reporting that the company experienced a data breach at its subsidiary Astrana Health Management, a management services organization that handles back-office functions for clients including independent physician groups. According to the 8-K, Astrana experienced a series of social engineering (AKA phishing) attempts in which attackers impersonated Astrana personnel in an effort to obtain unauthorized access to Astrana’s systems. Upon discovery, Astrana reset the affected credentials and took other remedial measures, in addition to launching an investigation into the nature and scope of the cyberattack(s). Astrana’s investigation remains ongoing, but has determined that private and/or confidential information maintained in its systems was accessed and/or acquired without authorization.

Astrana continues to assess whether, and to what extent, the breach impacted info belonging to patients, employees, credentialed providers, and other persons. Further details, including the precise categories of information that may have been compromised, are also under investigation. Astrana stated that it intends to make all required notifications, including to any affected patients, based on the findings of its investigation.

What Information Was Impacted?

While Astrana is still investigating what categories of information were subject to access/acquisition by the attacker(s), the following categories of information may have been compromised:

• Names;
• Information about medical treatment, condition, or diagnosis;
• Health insurance information;
• Sensitive personal identifiers such as Social Security number; and
• Other sensitive personal information and protected health information.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected persons are entitled to compensation. If you are a current or former patient of a provider who uses Astrana’s services (such as Allied Pacific of California IPA), there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.