Astrana Health Data Breach Lawsuit: Five Federal Suits, No Settlement
Active Litigation
Astrana Health runs the back office for physician groups and clinics, so you may know it only through your doctor. In September 2026 it told the SEC that callers spoofing its main phone number contacted employees to get into its systems and that confidential data was accessed and/or acquired without authorization. Within three weeks at least five proposed class actions were filed in Los Angeles federal court. As of October 17, 2026 there is no count of affected people, no notice letter on file and no settlement.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Astrana Health Data Breach
Astrana Health, Inc. is a Nasdaq-listed company based in Alhambra, California (ticker ASTH). It organizes networks of affiliated doctors and owns clinics; its 2025 annual report counts 20K+ providers and 1.6M members in value-based care.
In a Form 8-K filed on September 23, 2026, Astrana said its subsidiary Astrana Health Management, Inc. detected unusual activity. The company described “a series of social engineering attempts” in which attackers impersonated staff and spoofed the company’s main corporate telephone number to get employees to grant access. Astrana said it believes private or confidential information on its servers “has been accessed and/or acquired without authorization” and that it determined the incident was material as of September 22, 2026.
The company has not said what data was taken. It was still assessing whether patient, employee, credentialed provider, business and financial information was involved, and said it intends to notify impacted patients. No hacking group had claimed the attack as of September 24, 2026, according to The Record.
Case details
All of the data breach suits found so far are in the U.S. District Court for the Central District of California:
• Reams v. Astrana Health, Inc., No. 2:26-cv-11215, Jessica v. Astrana Health, Inc., No. 2:26-cv-11213, and Custodio v. Astrana Health Management, Inc., No. 2:26-cv-11223 — filed September 28, 2026.
• Pollard v. Astrana Health, Inc., No. 2:26-cv-11347 — filed September 30, 2026 by California residents.
• Gaither v. Astrana Health, Inc., No. 2:26-cv-11929 — filed October 13, 2026 by a Nevada patient, naming both Astrana Health, Inc. and Astrana Health Management, Inc.
A further case on the same court’s docket, Maria Ortiz v. Astrana Health Inc et al., No. 2:26-cv-11151, could not be confirmed as a breach case. Separately, a wage-and-hour class action against Astrana Health Management (Case No. 26STCV21467, Los Angeles County Superior Court, announced August 9, 2026) concerns meal and rest breaks, not the breach.
Status: Complaints Filed, No Settlement
There is no settlement, no fund, no administrator, no claim form and no deadline. Astrana’s SEC filing is the only official account so far, and it gives no count of affected people.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Latest From the Court Docket
Recent entries in the federal cases behind this page, taken from the court's own docket. We check it at least once a day; this list is as of Oct 17, 2026.
Oct 15, 2026
Text Only Scheduling Notice
Maria Ortiz v. Astrana Health Inc et al, No. 2:26-cv-11151 (C.D. Cal.)
Oct 13, 2026
Complaint (Attorney Civil Case Opening)
Gaither v. Astrana Health, Inc et al, No. 2:26-cv-11929 (C.D. Cal.), ECF No. 1
Oct 9, 2026
Order
Jessica v. Astrana Health, Inc., No. 2:26-cv-11213 (C.D. Cal.), ECF No. 11
All 3 dockets with recent entries
Maria Ortiz v. Astrana Health Inc et al
No. 2:26-cv-11151 · C.D. Cal. · latest entry Oct 15, 2026
Find this docket on CourtListenerGaither v. Astrana Health, Inc et al
No. 2:26-cv-11929 · C.D. Cal. · latest entry Oct 14, 2026
Find this docket on CourtListenerJessica v. Astrana Health, Inc.
No. 2:26-cv-11213 · C.D. Cal. · latest entry Oct 9, 2026
Docket on CourtListener
A docket entry is a step in the case, not a decision on who wins. Sources: the courts' PACER feeds and CourtListener (Free Law Project). Not legal advice.
Am I Affected?
Nobody can say yet. Astrana has not published a number, the complaints say the number is not yet known, and the California Attorney General’s breach list had no Astrana entry as of October 14, 2026.
Watch your mail. Astrana has said it will notify impacted patients. Because it works behind physician groups, the letter may name Astrana Health, Astrana Health Management or your medical group. Keep the letter and envelope — it lists your exposed data and is your proof of membership.
The proposed classes are broad: the Gaither complaint seeks a nationwide class of everyone in the United States whose private information was compromised. You do not need to sign up; if a class is certified or a settlement is reached, notice goes to class members directly.
Is There Money? Not Yet
For context only: resolved healthcare breach cases usually reimburse documented losses, sometimes add a small flat payment, and offer credit monitoring. Our data breach settlement calculator shows how those tiers usually work.
Astrana Health Breach Timeline
September 22, 2026 — Breach Deemed Material
Astrana determines that the social engineering incident at Astrana Health Management is material because of the potential confidential and sensitive nature of the data involved.
September 23, 2026 — SEC Disclosure
Astrana files a Form 8-K saying confidential information was accessed or acquired. No count and no data types are given.
September 28, 2026 — First Lawsuits
Reams, Jessica and Custodio are filed in the Central District of California.
September 30, 2026 — Pollard Filed
California residents sue, alleging names, Social Security numbers, insurance information and medical records were taken.
October 13, 2026 — Gaither Filed
A Nevada patient sues both Astrana entities and seeks a nationwide class plus $1,000 per person under California’s medical privacy law.
October 17, 2026 — No Count, No Settlement
No affected-person count or notice letter is public. The suits are at the complaint stage; nothing can be claimed.
Three Things to Watch For
This breach began with fake phone calls, and the copycats are predictable:
Calls from “Astrana” caller ID
The attackers spoofed Astrana’s main corporate number. Caller ID proves nothing. Hang up and call your doctor’s office at a number you already have.
“Claim your Astrana settlement” links
There is no settlement and no claim form. A site asking for your Social Security number to “register” for the Astrana Health data breach lawsuit is collecting data, not filing a claim.
Fake breach notice letters or texts
Astrana has said it will notify affected patients. Real notices do not ask for payment or your full Social Security number. Check any letter against your medical group before you call a number printed on it.
Astrana Health Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Is there an Astrana Health data breach lawsuit?
Yes. At least five proposed class actions are pending in the Central District of California, the earliest filed September 28, 2026 and the latest, Gaither (No. 2:26-cv-11929), on October 13, 2026. None has been certified or tested in court.
What healthcare company got hacked, and who is Astrana?
Astrana Health is a California healthcare company that runs provider networks and clinics, and its Astrana Health Management unit was the one breached. The Record put its reach at about 20,000 medical providers. You may never have dealt with it directly.
What data was exposed?
Astrana has not said. Its SEC filing lists patient, employee, credentialed provider, business and financial information as possibilities. The Pollard complaint alleges, on information and belief, names, Social Security numbers, dates of birth, addresses, health insurance information and medical records.
How many people were affected?
Unknown as of October 17, 2026. The 8-K gives no count, and no state attorney general listing had appeared as of October 14, 2026. The Gaither complaint alleges the breach had not been reported to HHS when it was filed.
How much compensation do you get for a data breach?
From this breach, nothing yet — there is no settlement. The Gaither complaint requests $1,000 per class member under California law, but that is a demand. Settled cases usually pay documented losses plus a smaller flat amount.
Do I need to do anything to join?
No. There is nothing to sign up for. If a class is certified or a settlement is approved, notice goes to class members directly, with any claim deadline stated in it.
Is this the same case as the MyChart lawsuits?
No. Our pages on the UCLA Health, UNC Health, UI Health and Yale New Haven Health MyChart lawsuits cover separate cases against those health systems. The Astrana Health data breach is a different incident and different defendants.
What should I do right now?
Freeze your credit at all three bureaus. Read your insurer’s explanation-of-benefits statements for care you never got. Keep any notice letter. Treat calls that show Astrana’s number with suspicion — that is how the attack worked.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Data Breach Settlement CalculatorEstimate what breach settlements typically pay per person
- Aesto Health Data BreachAnother 2026 healthcare vendor breach and its lawsuits
- Amgen Data Breach LawsuitSued soon after an SEC breach disclosure, like Astrana