The Chaos ransomware group listed US value-based-care company Astrana Health on its data-leak site on 9 October, claiming 1,500 GB of data "published in their entirety", including the data and diagnoses of "millions of patients", and alleging management withdrew from a ransom deal to save money. Astrana disclosed in a 23 September SEC 8-K that attackers impersonated company personnel and spoofed its main corporate phone number in voice-social-engineering attacks to access servers at subsidiary Astrana Health Management; the company believes private and confidential information was accessed and exfiltrated, restored certain systems from clean backups, and notified law enforcement, regulators and partners. The company — whose platform serves roughly 20,000 medical providers — had not quantified affected records, and no group had claimed the attack as of 2 October. The Chaos listing remains an adversary allegation: the claimed volume, patient counts and attribution are unverified.

• Source article