People whose information was involved in Astrana Health’s September 2026 data breach may be covered by proposed class actions alleging Astrana Health failed to protect patients’ personal and health information. Astrana has not said whose data was taken, no class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Astrana Health, Inc. and Astrana Health Management, Inc. have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Astrana Health?
Astrana Health, Inc. is a Nasdaq-listed healthcare company based in Alhambra, California, that works with networks of affiliated physicians and medical groups. One of the complaints says it serves patients in California, Nevada, Texas and eight other states. On September 23, 2026, Astrana told the Securities and Exchange Commission in a Form 8-K that its subsidiary, Astrana Health Management, Inc., had detected unusual activity in its systems.According to that filing, the incident involved a series of social engineering attempts: people posing as Astrana personnel, and spoofing the company’s main corporate phone number, contacted certain employees to try to get into company systems. Astrana said it believes certain private or confidential information on its servers was accessed or acquired without authorization, and that it determined the incident was material as of September 22, 2026. It said it was still assessing whether patient, employee, credentialed provider, business and financial information, or other information was involved, and that it intends to make all required notifications, including to affected patients.
The newest lawsuit, Gaither v. Astrana Health, Inc., No. 2:26-cv-11929, was filed on October 13, 2026 in the U.S. District Court for the Central District of California. It names both Astrana Health, Inc. and Astrana Health Management, Inc. as defendants and was brought by a Nevada resident who says she is a current Astrana patient. An earlier proposed class action, Pollard v. Astrana Health, Inc., No. 2:26-cv-11347, was filed in the same court on September 30, 2026 by California residents, one of them suing on behalf of a minor child.
Court records also show three more suits against Astrana filed in that court on September 28, 2026: Reams v. Astrana Health, Inc., No. 2:26-cv-11215; Jessica v. Astrana Health, Inc., No. 2:26-cv-11213; and Custodio v. Astrana Health Management, Inc., No. 2:26-cv-11223. Their complaints were not publicly available for review. The Reams and Jessica dockets, like those in Gaither and Pollard, include notices of related cases. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Lawsuits Allege
The Gaither and Pollard complaints both quote Astrana’s SEC filing and build on it. Together they allege that:- Astrana required patients to hand over personal information to receive care; the Gaither plaintiff says she gave it her name, contact information, date of birth, Social Security number and driver’s license number
- Astrana did not have reasonable safeguards, policies and monitoring in place to prevent, detect and stop the breach, and did not follow industry practices such as employee training, multi-factor authentication and encryption
- On information and belief, the information taken included protected health information; the Pollard complaint lists names, Social Security numbers, dates of birth, addresses, health insurance information and medical records
- As of filing, Astrana had not notified the people affected, and the Gaither complaint says, on information and belief, that it had not reported the breach to state or federal regulators, including the U.S. Department of Health and Human Services’ Office for Civil Rights
- The people affected face an ongoing risk of identity theft, medical identity theft and fraud
The Gaither plaintiff says she has spent about 20 hours dealing with the breach and has seen a sharp increase in spam. Astrana has not responded to the complaints in court, and none of the allegations has been tested.
Who Is in the Proposed Class?
The Gaither complaint proposes a nationwide class of all individuals in the United States whose private information was compromised in the data breach. It excludes Astrana and its parents, subsidiaries, affiliates, officers and directors, entities Astrana controls, people who opt out, and the judges assigned to the case. The Pollard complaint proposes a similar class of people living in the United States whose information was compromised in the breach Astrana discovered in September 2026, including anyone who receives a notice. These definitions are proposals; a court would have to certify a class before anyone is formally part of the case.Legal Claims and What the Lawsuits Seek
The Gaither complaint brings six claims: negligence and negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, and violations of California’s Unfair Competition Law and the Confidentiality of Medical Information Act (CMIA). Under the CMIA it asks for nominal damages of $1,000 per class member, which the complaint says the statute allows without proof of actual damages. It also asks for actual, compensatory and punitive damages, restitution, and court orders requiring Astrana to encrypt the data it holds, delete information it has no reason to keep, bring in independent security auditors, train employees at least once a year, and submit to an independent annual SOC 2 Type 2 assessment for seven years.The Pollard complaint pleads negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty, along with claims under the Unfair Competition Law, the California Consumer Privacy Act, the California Customer Records Act and the CMIA. Those are requests, not amounts anyone has been awarded.
What Is Still Unknown
Astrana has not said how many people were affected or what kinds of information were taken. Its SEC filing gives no count, the complaints say the number is not yet known, and the California Attorney General’s data breach database had no Astrana listing as of October 14, 2026. The complaints’ descriptions of the stolen data are made on information and belief rather than drawn from a company notice. Notification letters and state filings, if Astrana sends them, would be the first official account of who was involved.Other healthcare data breaches have drawn similar suits this year. Amgen was sued six days after its own SEC disclosure, before it had said how many people were involved, and MedImpact faces a suit over a breach that exposed plan members’ health and insurance data.
What Happens Next
Several of the Astrana suits were filed with notices of related cases, and suits over the same breach in the same court are commonly coordinated or consolidated into one case. More may be filed. Astrana would then respond, often with a motion to dismiss. The case could also settle; data breach settlements typically reimburse documented losses, sometimes pay a flat amount, and require a claim form.There is nothing to file in the lawsuits now. If a settlement is reached, people whose information was involved would normally receive a notice explaining how to file a claim.
Questions
Is there an Astrana Health data breach class action?
Yes. Gaither v. Astrana Health, Inc., No. 2:26-cv-11929, was filed on October 13, 2026 in the U.S. District Court for the Central District of California, and Pollard v. Astrana Health, Inc., No. 2:26-cv-11347, was filed in the same court on September 30, 2026. Both are proposed class actions over the breach Astrana disclosed to the SEC. Three more suits against Astrana were filed in that court on September 28, 2026; their complaints were not publicly available. All are at the complaint stage. No class has been certified and there is nothing to claim yet.
What happened in the Astrana Health data breach?
In a Form 8-K filed with the SEC on September 23, 2026, Astrana Health said its subsidiary Astrana Health Management detected unusual activity. Astrana said the incident involved social engineering attempts in which people impersonating company personnel, and spoofing its main corporate phone number, contacted employees to try to gain access to company systems, and that it believes certain private or confidential information on its servers was accessed or acquired without authorization.
Was patient information exposed in the Astrana breach?
Astrana has not said. Its SEC filing said it was still assessing whether patient, employee, credentialed provider, business, financial or other information was accessed, and that it intends to make required notifications, including to affected patients. The complaints allege, on information and belief, that the data included protected health information; the Pollard complaint lists names, Social Security numbers, dates of birth, addresses, health insurance information and medical records.
How many people were affected by the Astrana Health data breach?
Astrana has not published a number. The company’s SEC filing gives no count, the complaints say the number is not yet known, and the California Attorney General’s data breach database had no Astrana listing as of October 14, 2026.
What happens next in the Astrana Health lawsuits?
Several of the suits were filed with notices of related cases in the same court, so they may be coordinated or consolidated. Astrana would then respond, often with a motion to dismiss. If the case settles, people whose information was involved would normally be notified and told how to file a claim.
Sources
• Class Action Complaint, Gaither v. Astrana Health, Inc., No. 2:26-cv-11929 (C.D. Cal., filed October 13, 2026): Gaither complaint (PDF) and docket.• Class Action Complaint, Pollard v. Astrana Health, Inc., No. 2:26-cv-11347 (C.D. Cal., filed September 30, 2026): Pollard complaint (PDF) and docket.
• Dockets: Reams v. Astrana Health, Inc., No. 2:26-cv-11215 (docket); Jessica v. Astrana Health, Inc., No. 2:26-cv-11213 (docket); and Custodio v. Astrana Health Management, Inc., No. 2:26-cv-11223 (docket).
• U.S. Securities and Exchange Commission: Astrana Health, Inc. Form 8-K, Item 1.05 Material Cybersecurity Incident (filed September 23, 2026).
• California Attorney General: Search Data Security Breaches (no Astrana listing as of October 14, 2026).
