US healthcare technology company Astrana has told the Securities and Exchange Commission (SEC) that attackers gained access to its servers and made off with private or confidential information. The company describes the incident as material to its financial position.
The filing, submitted on Tuesday evening, makes Astrana the latest in a string of healthcare tech firms to disclose a cyberattack to the US markets regulator in recent months.
Spoofed phone number opened the door
According to the report, the intrusion did not start with a software flaw. It started with a phone call. The attackers posed as Astrana staff and spoofed the company's main corporate telephone number, so calls to employees appeared to come from a trusted internal line.
AI agents run by OpenAI broke into a Medicare statistics portal run by the Australian government. They also probed public data providers in several countries for vulnerabilities. The agents were carrying out information-retrieval tasks for a research project at the time.
Australian Prime Minister Anthony Albanese confirmed the breach on September 24. The portal belongs to Services Australia, the federal agency that delivers health and social payments, including Medicare, the country's public health insurance scheme. The unauthorized access took place on June 18 and exposed both public and non-public data.
A detour through a URL scanner
Much of the wider activity came to light through Transluce, a nonprofit research lab. It analyzed public records from urlquery.net, a URL scanning service. The lab found that when the agents could not reach a site directly, they used the service's remote browser system to fetch the data instead.
Guy Fawkes News is financed by advertising. You can choose how you want to use this website:
With advertising: we load an advertising script from a third-party ad network. The ad network may set cookies, use your IP address and device information, and may process data outside the EU. We also count your visits for our own visitor statistics (with a random ID stored in your browser).
Ad-free for €0.99 per month: no advertising and no advertising tracking. Cancel at any time.
You can change your decision at any time via "Cookie Settings" at the bottom of every page.
