Astrana Health, Inc.

Current report

We have in the past, and may in the future, experience cybersecurity incidents. Breaches or compromises of our information security systems or our information technology systems or infrastructure could result in exposure of private and protected health information, disruption of our business, and damage to our reputation, which could harm our business, results of operation, and financial condition.

Current report

In the ordinary course of our business, we create, receive, maintain, transmit, collect, store, use, disclose, share, and process sensitive data, including PHI and other types of personal data or personally identifiable information (collectively, “PII” and, together with PHI, “PHI/PII”) relating to our patients, employees, vendors, and others. We also contract with third-party service providers to process sensitive information, including PHI/PII, confidential information, and other proprietary business information. We depend heavily on information technology networks and systems, including the internet, to securely process PHI/PII and other sensitive data and information. Security breaches of this infrastructure, whether ours or of our third-party service providers, including physical or electronic break-ins, employee or service provider error, third-party action, including actions of foreign actors, insider attacks, phishing or denial-of-service attacks, the introduction of computer viruses and/or malicious or destructive code, ransomware or other malware, social engineering, malfeasance, other unauthorized physical or electronic access, or other vulnerabilities, could result in system disruptions, shutdowns or unauthorized access, acquisition, use, disclosure or modifications of such data or information, and could cause PHI/PII to be accessed, acquired, used, disclosed or modified without authorization, to be made publicly available, or to be further accessed, acquired, used or disclosed. Such incidents could also lead to widespread technology outages, interruptions, or other failures of operational communication or other systems globally and across companies and industries. We completed the Prospect acquisition during 2025, and integrating the information technology, communications, and other systems could increase the risk of security breaches.

Current report

We have experienced cyber incidents in the past and may experience other incidents in the future. For example, as previously disclosed in our Current Report on Form 8-K filed with the SEC on September 23, 2026, during the third quarter of 2026, we identified a series of social engineering attempts in which individuals, impersonating our personnel and spoofing our main corporate telephone number, contacted certain employees in an effort to obtain unauthorized access to our systems. As a result, certain private and/or confidential information maintained on our servers was accessed and acquired without authorization (the “Cybersecurity Incident”). We expect to continue to incur costs related to the incident, for ongoing fees to cybersecurity experts and other advisors, as well as additional remediation, litigation, and notification-related expenses and costs. We have taken, and continue to take, steps to contain, investigate, and remediate the Cybersecurity Incident and enhance the security of our systems. However, there can be no assurance that these remediation efforts will be successful, that we have identified all information that was accessed or acquired, or that the measures we have implemented or may implement will prevent future cybersecurity incidents. While we maintain cybersecurity insurance, we expect that such insurance may not cover all costs related to the Cybersecurity Incident. We continue to face risks relating to this incident, including possible harm to our reputation and customer, provider and patient relationships, and ongoing litigation, as well as regulatory scrutiny. In addition, because our investigation of this incident remains ongoing, we may discover other impacts or new related events that could affect our business, operating results, or financial condition.

Current report

We use third-party service providers for important aspects of processing employee and patient PHI/PII and other confidential and sensitive data and information, and therefore rely on third parties to manage functions with material cybersecurity risks. Because we do not control our vendors or service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or prevent any disruption arising from a technology failure, cyber-attack or other information or security breach. We depend on such parties to implement adequate controls and safeguards to protect against and report cyber incidents. If such parties fail to deter, detect or report cyber incidents in a timely manner, we may suffer from financial and other harm, including to our information, operations, performance, employees and reputation. In addition, because of the sensitivity of the PHI/PII and other sensitive data and information that we and our service providers process, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. We have implemented certain administrative, physical, and technological safeguards to address these risks; however, such policies and procedures may not address certain HIPAA requirements or address situations that could lead to increased privacy or security risks. We may be required to expend significant capital and other resources to protect against security breaches, to safeguard the privacy, security, and confidentiality of PHI/PII and other sensitive data and information, to investigate, contain, remediate, and mitigate actual or potential security breaches, and/or to report security breaches to patients, employees, regulators, media, credit bureaus, and other third parties in accordance with applicable law and to offer complimentary credit monitoring, identity theft protection, and similar services to patients and/or employees where required by law or otherwise appropriate. Cyber-attacks are becoming more sophisticated and frequent, and we or our third-party service providers may be unable to anticipate these techniques or implement adequate protective measures against them or to prevent future attacks, and future cyber-attacks could go undetected and persist for an extended period of time. Furthermore, to the extent AI capabilities continue to improve and are increasingly adopted, they may be used to identify vulnerabilities and craft increasingly sophisticated cybersecurity attacks, including the use of generative AI to conduct more sophisticated social engineering attacks on the Company, suppliers or customers. In addition, vulnerabilities may be introduced from the use of AI by us and our third-party service providers.

Current report

A security breach, security incident, third-party outage, or privacy violation that leads to unauthorized use, disclosure, access, acquisition, loss, or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, patient or employee information, including PHI/PII that we or our third-party service providers process, or other confidential information could harm our reputation and business, compel us to comply with breach notification laws, cause us to incur significant costs for investigation, containment, remediation, mitigation, fines, penalties, settlements, notification to individuals, regulators, media, credit bureaus, and other third parties, complimentary credit monitoring, identity theft protection, training, and similar services to participants and/or employees where required by law or otherwise appropriate, for measures intended to repair or replace systems or technology and to prevent future occurrences. In addition, security breaches and incidents, and other compromises or inappropriate access to, or acquisition or processing of, PHI/PII or other sensitive data or information can be difficult to detect, and any delay in identifying such breaches or incidents or in providing timely notification of such incidents may lead to increased harm and increased penalties. Furthermore, the determination of whether a cybersecurity incident is “material” requires judgment and may be subject to regulatory scrutiny. Failure to timely disclose a material cybersecurity incident or to maintain adequate cybersecurity risk management disclosure controls and procedures could result in SEC enforcement actions, shareholder litigation, reputational harm, and other adverse consequences. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.

Current report

If we or our third-party service providers are unable to prevent or mitigate security breaches, security incidents, outages or privacy violations in the future, or if we or our third-party service providers are unable to implement satisfactory remedial measures with respect to known or future security incidents or outages, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of patients, loss of reputation, adverse impacts on patient and investor confidence, financial loss, litigation, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability.

Current report

ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

Current report

In December 2022, Astrana’s Board of Directors approved a share repurchase program authorizing the Company to repurchase up to $50.0 million of its shares of common stock. In February 2026, the Board of Directors increased the total authorization under the share repurchase program to $100.0 million of its shares of common stock, including the $35.9 million that remained available under the previously announced stock repurchase program. Repurchases may be made through a variety of methods, which could include open market purchases, accelerated share repurchase transactions, negotiated block transactions, 10b5-1 plans, other transactions that may be structured through investment banking institutions or privately negotiated, or a combination of the foregoing. This share repurchase program has no expiration date. The Board may suspend, modify, or discontinue the repurchase program at any time. This repurchase program does not obligate the Company to make additional repurchases at any specific time or in any specific situation. During the three months ended September 30, 2026, no shares were repurchased under the Company’s share repurchase program. As of September 30, 2026, $83.1 million remained available under the repurchase program.

Current report

The following table provides information about purchases made by the Company of the Company’s common stock during the three months ended September 30, 2026.

Current report

Includes 38,483 shares repurchased to satisfy tax withholding obligations due upon the vesting of restricted stock awards held by certain employees. We did not pay cash to repurchase these shares, nor were these repurchases part of a publicly announced plan or program.

Current report

Includes 28,500 shares of common stock repurchased from two members of the Board of Directors during August 2026.

Current report

ITEM 3. DEFAULTS UPON SENIOR SECURITIES

Current report

None.

Current report

ITEM 4. MINE SAFETY DISCLOSURES

Current report

Not applicable.