Social engineering in SEC 8-K filings: how attackers got in, what they took

What this guide covers

This guide reads four Form 8-K filings from public companies that tie an intrusion to social engineering: Caesars Entertainment, AdaptHealth, Astrana Health and iRhythm Holdings. Everything below comes from those filings and is attributed to the company that wrote it. Each statement is the company's own account at the time of filing, while its investigation was still open. None is an independent finding.

The question behind this guide is about help-desk, phone and vendor methods. The filings cover those unevenly. None of the four uses the phrase "help desk." One describes a telephone method. Two describe a vendor or contractor route. One says only that the data came from third-party-hosted applications through social engineering. The sections below take each filing in turn and then compare what the companies say about data and response.

Vendor and contractor routes: Caesars and AdaptHealth

The Caesars filing says the company identified suspicious activity that resulted from a social engineering attack on an outsourced vendor, in this wording: the filing describes "suspicious activity in its information technology network resulting from a social engineering attack on an outsourced IT support vendor used by the Company." The filing names the vendor route but gives no further detail on the technique, so this guide adds none.

On the data, Caesars says that on September 7, 2023, it reached a conclusion about what the attacker took, writing that "on September 7, 2023, we determined that the unauthorized actor acquired a copy of, among other data, our loyalty program database." The company says the database holds sensitive identifiers, describing a database "which includes driver's license numbers and/or social security numbers for a significant number of members in the database." Caesars also states what it had not found, saying "We have no evidence to date that any member passwords/PINs, bank account information, or payment card information (PCI) were acquired by the unauthorized actor."

On the vendor itself, Caesars says it acted on the third party's side of the problem, stating "We have also taken steps to ensure that the specific outsourced IT support vendor involved in this matter has implemented corrective measures."

The AdaptHealth filing describes a narrower vendor route, a single session. The company says the incident "was the result of a successful social engineering attack that compromised a user session associated with a third-party contractor." AdaptHealth says the access reached business systems, stating that it believes a threat actor "gained unauthorized access to certain of the Company's cloud-based business applications, including certain internal patient management systems and document storage platforms."

AdaptHealth lists the data affected, saying "The data affected includes passwords associated with insurance billing and certain personally identifiable information and protected health information of patients." For containment, the company describes steps "including disabling the compromised user account, resetting affected credentials, and implementing additional access controls, and the incident has been contained." AdaptHealth also gives its materiality date, writing that "on June 27, 2026, the Company determined that the incident is material, due to the nature and potential volume of the data that is at risk."

The phone route: Astrana Health

Astrana's filing is the one of the four that describes a telephone method. It says the incident involved a series of attempts in which "threat actors, impersonating Company personnel and spoofing the Company's main corporate telephone number, contacted certain employees in an effort to obtain unauthorized access to Company systems."

The filing lists the remedial steps the company took, naming "resetting affected credentials, restricting remote access tools, restoring certain systems from clean backups, and enhancing monitoring, logging, and detection capabilities across its environment."

On access, Astrana says its belief at the time of filing was that "certain private and/or confidential information maintained on the Company's servers has been accessed and/or acquired without authorization." The company dates its materiality decision, stating that "the Company has determined that the incident is material as of September 22, 2026."

Third-party-hosted applications: iRhythm

The iRhythm filing is the shortest on method. It gives the discovery date, saying that on June 8, 2026, the company "identified unauthorized activity involving data maintained on certain third-party-hosted business applications." On method, the company says "the affected data was obtained through social engineering and is from certain third-party-hosted business applications."

iRhythm is the only one of the four that describes an extortion demand. It says "The communications from the threat actor demanded payment in exchange for not publicly disclosing this information." The company also reports on ongoing access, stating that "the Company has not identified evidence of ongoing unauthorized access to its systems."

What the filings leave open

Two of the filings say plainly that the data picture was incomplete when they were filed. AdaptHealth states that "specific information regarding the volume of data at issue is not yet available." Astrana says it "continues to assess whether, and to what extent, patient, employee, credentialed provider, confidential business and financial information" was affected.

This is the main difference between the Caesars filing and the other three. Caesars names a specific database and specific identifier types, while the other filings use broader categories. The filings are written at different points in each investigation, so the level of detail should not be read as a comparison of the companies.

How to read the four together

Three things stand out when the filings are read side by side. The first is how each names the entry point: a vendor organization, a contractor's user session, impersonated company staff on the phone, or third-party-hosted applications. The second is how specific each is about the data, from a named database to broad categories. The third is whether the filing says the access is over.

The filings differ on all three, and the quoted passages above show where. This guide does not rank the companies or judge any of the responses. It reports what each company chose to put in its own filing.