US healthcare technology company Astrana has told the Securities and Exchange Commission (SEC) that attackers gained access to its servers and made off with private or confidential information. The company describes the incident as material to its financial position.

The filing, submitted on Tuesday evening, makes Astrana the latest in a string of healthcare tech firms to disclose a cyberattack to the US markets regulator in recent months.

Spoofed phone number opened the door

According to the report, the intrusion did not start with a software flaw. It started with a phone call. The attackers posed as Astrana staff and spoofed the company's main corporate telephone number, so calls to employees appeared to come from a trusted internal line.

Read More