Astrana Staff Fooled by Spoofed Phone Calls

Astrana Health disclosed that attackers stole private and confidential data after using social engineering to trick employees. The attackers impersonated Astrana personnel and spoofed the company’s main phone number to contact staff, leading to unauthorized access to servers and data exfiltration.

Key findings

• Attackers used social engineering by impersonating internal personnel and spoofing Astrana’s main phone number to contact employees.
• The intrusion resulted in unauthorized access to servers and exfiltration of private and confidential information.
• Astrana rotated credentials, restricted remote access tools, rebuilt some systems from clean backups, and improved monitoring/logging/detection.
• Astrana has not named the threat actor, and no known ransomware/extortion group was seen claiming responsibility.

Who’s being targeted

• Commonly targeted roles: All employees, IT and Helpdesk, Remote access tool users, Security team.
• Affected industries: Healthcare, Physician practice management, Medical billing and claims administration.
• Attack channels: vishing.
• Impersonated: Astrana Health personnel (internal staff).

Awareness takeaways

• Treat inbound phone calls as untrusted, even if caller ID shows an internal/company number, and verify identity via a separate, known-good method.
• Train employees to refuse requests that could grant system access (credentials, remote tool access, “help me log in”), and escalate to security/IT using official channels.
• Plan and practice containment steps for suspected social-engineering-led intrusions (credential rotation, limiting remote access tools, restore from clean backups, improve monitoring).

Red flags to watch for

• Caller ID shows the company’s main number, but the request is unusual/urgent
• The caller pressures the employee to help with access to systems
• The caller’s identity is not independently verified through a known internal process