Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Astrana Health data breach. According to dark web monitoring sources, a hacker group calling itself Falcon claimed responsibility for a cyberattack on Astrana Health in a post first observed in October 2026, alleging it had gained access to internal company systems. As of this writing, Astrana Health has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Astrana Health
Astrana Health, Inc. (NASDAQ: ASTH) is a physician-centric, technology-powered, risk-bearing healthcare management company headquartered in Alhambra, California. Formerly known as Apollo Medical Holdings, the company rebranded in February 2024. It operates an integrated healthcare delivery platform providing value-based care services, including primary care, multi-specialty care, claims and billing, and back-office support for independent physicians. The company serves over 1.6 million patient members and more than 20,000 in-network providers across eleven states.
What Happened?
Astrana Health is the subject of a corroborated ransomware report. On September 23rd, 2026, the company disclosed the incident via a Form 8-K filed with the SEC. According to that filing, the company’s subsidiary Astrana Health Management detected unusual activity after threat actors used social engineering tactics—impersonating company personnel and spoofing its main corporate phone number—to contact employees and gain unauthorized access to company servers. Astrana determined the incident to be material as of September 22nd, 2026, citing “the potential confidential and sensitive nature of the data involved.” The company engaged third-party cybersecurity and digital forensics experts, notified law enforcement and regulators, reset credentials, restricted remote access tools, and restored systems from clean backups. As of reporting, the company stated it does not expect a material impact on its financial condition or operations and holds a cyber insurance policy that may cover certain losses. The company has not disclosed the specific types of data compromised or the number of individuals affected; its investigation is ongoing.
Separately, on October 25th, 2026—approximately one month after Astrana’s SEC disclosure—the Falcon ransomware group posted a claim on its dark web leak site alleging a 738 GB extraction of data including internal documents, financial records, regulatory audit reports, user credential lists, client contact lists, and employee personally identifiable information. These are attacker-side allegations only and have not been confirmed by Astrana Health. Notably, as of late September 2026, no ransomware group had yet publicly claimed responsibility for the attack. Falcon is an emerging group first observed in August 2026 that operates a double-extortion model; its claims should be treated with particular caution given its nascent status. Multiple law firms—including Scott+Scott Attorneys at Law LLP, Shamis & Gentile P.A., Girard Sharp, and Goldenberg Schneider LPA—have launched investigations into potential class action lawsuits, though no filed complaint has been identified as of this writing.
Key Facts at a Glance
- Company or Organization: Astrana Health, Inc. (NASDAQ: ASTH)
- Industry: Healthcare / Healthcare Providers & Services / Practice Management
- Location: Alhambra, California, USA
- Incident type: Social engineering attack resulting in unauthorized server access and data theft; separate ransomware claim by the Falcon group (unconfirmed by company)
- Date of consumer notification: September 23rd, 2026 (SEC Form 8-K disclosure)
- Litigation status: Multiple law firms investigating potential class actions as of October 2026; no filed complaint identified
- Source: SecurityWeek, HIPAA Journal, Girard Sharp, The Lyon Firm, Scott+Scott, WatchGuard Falcon profile
What Should You Do?
If you believe you may have been affected by the Astrana Health breach, act promptly to protect yourself. Consider placing a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to help prevent new accounts from being opened in your name. Review your credit reports for any unfamiliar activity at AnnualCreditReport.com, and monitor your financial accounts closely. Because Astrana Health’s services include claims and billing in a healthcare context, it is also worth reviewing any Explanation of Benefits statements you receive from your health insurer and checking your medical records for services you did not receive. If you detect signs of fraud or identity theft, you can report them and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
