Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
12OCT

Astrana Health files 8-K over phone spoof

3 min read
10:55UTC

Astrana Health called a phone-impersonation breach material because of the data taken, while CenterPoint Energy, Veradigm and Conduent filed under the voluntary item.

← Back to China alert puts old bugs on a 3-day clockJump to analysis ↓
TechnologyAssessed
Key takeaway

Astrana Health declared its phone-spoofing breach material on data exposure alone.

Astrana Health filed an 8-K under Item 1.05, the material cybersecurity incident item, with the SEC, the American markets regulator, on 23 September⁠1. Attackers had impersonated staff and spoofed the company's main corporate phone number to talk employees into giving them access. Astrana called the incident material because of the patient, employee and provider data involved, while expecting no material hit to its financial results.

Astrana was one of only two companies to use Item 1.05 in the period, by a keyword search of the SEC's Electronic Data Gathering, Analysis and Retrieval (EDGAR) database. That search gives a floor rather than a full count.

CenterPoint Energy, the Houston utility, filed under Item 8.01, the voluntary disclosure item, on 14 September⁠2. It said an unauthorised party obtained personal information on some customers through an external-facing system, and that a material impact is not reasonably likely. Veradigm and Conduent also filed under Item 8.01; none of the three declared a material incident. River Financial went the other way in June, filing under Item 1.05 and then leaving materiality undetermined in later amendments.

Deep Analysis

In plain English

Companies listed on US stock markets must tell the Securities and Exchange Commission (SEC), the market regulator, about cyber attacks. They choose between two sections of a form called an 8-K. Item 1.05 is for serious, or material, incidents. Item 8.01 is a voluntary section for anything else they want to share. Astrana Health, a US healthcare company, used the serious section after criminals called its staff while faking the company's own phone number and pretending to be colleagues. Three other companies, including Houston energy supplier CenterPoint Energy, reported break-ins under the voluntary section instead.

Deep Analysis
Root Causes

Caller ID can still be forged on calls that cross networks outside the FCC's STIR/SHAKEN authentication framework, so a call showing a company's own switchboard number proves nothing. Staff trained to trust internal numbers have no way to check.

Healthcare help desks reset credentials for clinicians who work odd hours across many sites, which pushes verification towards speed. Astrana's remediation included restricting remote access tools, a sign the callers talked staff into installing or approving remote-control software.

The SEC's rule leaves the materiality decision to each board, with no common threshold, so disclosure routes diverge by company judgement rather than by incident size.

What could happen next?
  • Precedent

    Declaring materiality on data sensitivity alone gives other healthcare filers a template that does not depend on financial impact.

  • Risk

    Caller-ID spoofing of a company's own number will keep defeating help-desk checks that rely on recognising the incoming line.

Sources:Securities and Exchange Commission·Securities and Exchange Commission
Mentions:Astrana Health →CenterPoint Energy →Veradigm →Conduent →Securities and Exchange Commission →Houston →River Financial Corporation →Scattered Spider →Federal Communications Commission →United States →STIR/SHAKEN →MGM Resorts →
First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

Securities and Exchange Commission· 12 Oct 2026
Read original →
Different Perspectives
ENISA
ENISA
ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.
LKA Hamburg
LKA Hamburg
Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.
ASOS
ASOS
ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.
Check Point
Check Point
Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.
Japan's National Police Agency
Japan's National Police Agency
Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.
CISA
CISA
CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.