> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Falcon ransomware group leaks 738 GB of Astrana Health data including PII and financial records - URL: https://f4n6.co.uk/security-feed/falcon-ransomware-group-leaks-738-gb-of-astrana-health-data-including-pii-and-financial-records/ - Published: 2026-10-26T15:48:59.000Z - Updated: 2026-10-26T15:48:59.000Z - Author: Jeff Davies - Tags: #security-feed, Falcon ## 1\. Executive summary On 2026-10-25 the ransomware group calling itself Falcon listed Astrana Health (US healthcare services, NASDAQ: ASTH) on its leak site, claiming a 738 GB extraction that includes employee PII, user credential lists, client contact lists, payer financial dispute trackers, funds transfer records and company financial statements. The listing states the victim made contact and then "timewasted", and that further attacks are coming. No CVE, CVSS score, EPSS value or CISA KEV entry is associated with this item, and Falcon has no MITRE ATT&CK profile, so the attribution and the group's capability claims are unconfirmed. For EMEA financial services the exposure is second-hand but direct: Astrana is a US payer-adjacent healthcare services firm, and any EMEA bank, insurer or payments provider that holds it as a counterparty, claims-processing partner or portfolio holding inherits third-party and, where funds transfer records are involved, fraud risk from the leaked financial data. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The leaked material includes payer financial dispute trackers and funds transfer records, which indicates Astrana sits in payment and claims flows that EMEA financial entities may depend on as an ICT third-party or counterparty. | Clients that contract Astrana, or a provider that routes through it, must confirm whether the relationship is an ICT third-party arrangement and whether the breach affects a service they rely on. | | DORA Art. 29 | The same dependency, if concentrated: a single US healthcare services provider holding reimbursement and funds transfer data for multiple EMEA counterparties is a concentration point. | Clients should assess whether their exposure to Astrana is concentrated enough to require a preliminary concentration-risk assessment. | | NIS2 Art. 21(2)(d) | The leak includes user credential lists and client contact lists, which are supply chain access material an attacker can reuse against connected entities. | In-scope entities must treat Astrana as a supply chain node and review the security measures applied to that link. | ## 3\. Technical analysis & attack chain The source is a leak-site listing, not an incident report. It gives the claimed data categories and the group's own statement, and nothing on initial access, tooling, persistence or command-and-control. The confirmed steps are limited to what the listing states. 1. Falcon claims to have extracted 738 GB from Astrana Health. 2. The extracted set, per the listing, includes internal documents, regulatory audit reports, payer financial dispute trackers, internal operational readiness reviews, acquisition pipelines, detailed reimbursement tables, internal system evaluations, regulatory notifications, funds transfer records showing liquidity status, company financial statements, user credential lists, client contact lists and employee PII decks. 3. Astrana contacted the group, which the group characterises as timewasting. 4. The group states further attacks are incoming. No initial access vector, exploited component, CVE, malware family, persistence mechanism, privilege escalation path, command-and-control channel or lateral movement detail is present in the source. The listing does not name a ransomware binary, a ransom note, a leak-site URL path or any file. The claim that "re-attacks" are coming is the group's assertion only; there is no technical evidence in the source of a second intrusion. The data categories matter more than the intrusion mechanics here. Funds transfer records showing liquidity status and payer financial dispute trackers are the kind of material used for business email compromise, invoice fraud and payment-diversion attempts against the victim's counterparties. User credential lists and client contact lists are reusable access and targeting material. Treat the listing as a fraud-enablement event for anyone transacting with Astrana, not only as a data breach. Confidence caveat: every fact above is single-sourced to the ransomware.live listing. The 738 GB figure, the data inventory and the "re-attacks incoming" statement are the actor's claims and have not been corroborated by Astrana, a regulator or an independent incident responder. The group name Falcon has no MITRE ATT&CK profile, so the attribution is unconfirmed and the group should not be conflated with any similarly named entity. ## 4\. Mitigation & containment P1 within 24h - Identify every EMEA business relationship with Astrana Health: counterparty, claims or reimbursement processing, vendor, or portfolio holding. Confirm with the relationship owner whether any payment, settlement or funds transfer instruction originates from or routes through Astrana. - Freeze out-of-band changes to payment instructions attributed to Astrana. Verify any new or changed bank details by callback to a known number, not to contact details in the request. - Add Astrana to the third-party watch list and require enhanced verification on inbound email and documents claiming to be from it, given the leaked client contact lists and credential lists. - Brief fraud and payments teams that funds transfer records and liquidity data may be circulating; expect invoice fraud and payment-diversion attempts referencing real Astrana detail. P2 within 72h - Review recent transactions and correspondence with Astrana for anomalies and retrospective fraud indicators. - Reset or rotate any shared credentials, portal accounts or API keys used to interact with Astrana systems. - Confirm whether Astrana is recorded as an ICT third-party provider under DORA Art. 28 and whether the contract has the key provisions under Art. 30 covering breach notification and data handling. P3 within 7 days - Complete a concentration-risk assessment under DORA Art. 29 if Astrana supports a service used by multiple parts of the business. - Review supply chain security measures for the Astrana link under NIS2 Art. 21(2)(d) if the entity is in scope. - Monitor Astrana's own disclosure and any regulator notification for corroboration of the listing. No vendor fix, patch or version applies: the source names no vulnerable product or CVE. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The listing gives no hashes, domains, IP addresses, file paths, registry keys or email addresses. The only machine-relevant artefact is the leak-site listing URL, which is a pointer to the actor's post rather than an indicator of the intrusion. | type | value | confidence | source | | ---- | ------------------------------------------------------------------- | ------------------------------------------------ | --------------- | | url | hxxps://www\[.\]ransomware\[.\]live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u | medium (listing page, not an intrusion artefact) | ransomware.live | ```iocs url hxxps://www[.]ransomware[.]live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u ``` Behavioural indicators, from the listing's stated data categories rather than from observed telemetry: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------- | | Inbound payment-instruction changes or invoice fraud referencing Astrana Health | Email gateway, payments workflow, fraud monitoring | low (inferred from leaked funds transfer and payer dispute data) | | Credential reuse against portals shared with Astrana | Identity provider, authentication logs | low (inferred from claimed user credential lists) | ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, file names, registry keys or ransom-note text. A rule built on the group name or the victim name would detect reporting about the event, not the threat. ## 7\. Sources - ransomware.live, "Ransomware: Falcon named Astrana Health (US)", https://www.ransomware.live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u, published 2026-10-25. - ransomware.live, "Victim: Astrana Health – Falcon", https://www.ransomware.live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u, undated listing page. Both sources are the same leak-site index entry; the data inventory and the "re-attacks incoming" claim rest on the actor's post alone. ## 8\. Adverse Trace position Adverse Trace assesses this as a data-exposure and fraud-enablement event with unconfirmed attribution and no technical indicators to hunt on. No CVE, CVSS score or CISA KEV entry applies, and Falcon has no MITRE ATT&CK profile, so the group's identity and capability claims are unverified and single-sourced to the leak-site listing. The risk to EMEA financial services is indirect: exposure runs through counterparty, claims-processing and payment relationships with Astrana, where leaked funds transfer records and payer dispute data can be used for payment diversion and invoice fraud. We will monitor for Astrana's own disclosure and any regulator notification to corroborate the listing, and we will reissue this advisory if a confirmed intrusion report, IOC set or attribution emerges. Clients should treat the next 72 hours as the window for payment-instruction verification against Astrana. --- [Read the original source →](https://www.ransomware.live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*