Breaches and incidents
Covered California: phishing exposes agent spreadsheets with SSNs or FEINs
Covered California’s notice to agents: “a phishing incident at Covered California on May 13, 2026 exposed your personal information”.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Covered California’s notice to agents: “a phishing incident at Covered California on May 13, 2026 exposed your personal information”; the intruder “accessed agent spreadsheets that included your name, agency name, license number, FEIN or Social Security number, and role within the agency.” The California AG lists it as breach date 05/13/2026, reported 10/16/2026. No count given.
- Root cause per Covered California: “an unauthorized individual used a phishing scheme to gain access to information relating to agents.”
- No attacker named.
- Covered California says it is strengthening security procedures and “reviewing the scope of the incident”; it recommends agents place fraud alerts. Notice came about five months after the incident.