Astrana Health falls 5% after reporting a "material" breach carried out by spoofing its own phone number

Shares of Astrana Health (ASTH) fell 5.4% to $33.22 at 1:57 p.m. ET on Wednesday, according to Nasdaq, after the company disclosed a cybersecurity incident in a Form 8-K filed with the SEC. It said "certain private and/or confidential information" on its servers was accessed or taken without authorization. CNBC listed the stock among the day's biggest midday decliners. At a market value of about $1.65 billion, the drop took roughly $94 million off the company's value (our calculation from Nasdaq's figures).

Astrana, which manages care for about 1.5 million members through more than 20,000 providers, according to its investor presentation, gets 61% of its revenue from Medicare. It said it is still working out whether patient, employee, provider, business or financial information was involved, and that it intends to notify affected patients.

What "material" does and does not mean here

The filing was made under Item 1.05, the SEC's rule for cybersecurity incidents a company considers material. That word drove the headlines. But the filing gives a narrower reason: Astrana said it deemed the incident material as of Sept. 22 "due to the potential confidential and sensitive nature of the data that is involved."

A few paragraphs later it says it "currently does not expect that it will have a material effect on the Company's financial condition and results of operations," and that it holds cyber insurance that may cover some losses, though it warns that coverage may not be enough. In short, the data is sensitive enough to trigger the rule, and the company is telling investors it does not currently expect the incident to damage its finances. It also says it cannot yet estimate remediation, legal, regulatory or reputational costs, and that it will amend the filing as it learns more.

For scale, the same-day investor presentation puts 2026 adjusted EBITDA guidance at $255 million to $280 million. Wednesday's roughly $94 million loss in market value equals about 35% of the $267.5 million midpoint. The company has given no cost estimate to set against that, so the share price is, for now, the only number on the table.

How the attackers got in, and who else it applies to

The method in the filing is not exotic. Attackers ran "a series of social engineering attempts," calling employees while pretending to be company staff and spoofing Astrana's main corporate phone number, to get access to its systems. The company said it reset credentials, restricted remote-access tools, restored some systems from clean backups, notified law enforcement and is notifying regulators and payer partners.

That attack works on any business, and a small one with no security team is easier to fool. A medical or dental practice, an accounting firm or an insurance agency that stores client records faces the same risk. A caller ID showing your own office number proves nothing. The cheapest fix is a rule that no one resets a password or installs remote-access software because of an incoming call, and that any such request gets a call back to a number you already know.

What investors are watching

• An amended 8-K with the scope of the data taken and the number of people affected.
• A first cost estimate, or any change to guidance, with third-quarter results.
• Reaction from payer partners, which Astrana is notifying.

More: stocks.

Sources: Astrana Health Form 8-K, Item 1.05; Astrana investor presentation (Exhibit 99.1); CNBC; Nasdaq. Market-value figures are our calculations. This is market information, not investment advice.