Unauthorized person entered Covered California spreadsheets through May 13 phishing attack

An unauthorized person entered Covered California spreadsheets containing agent information through a phishing attack on May 13, 2026.

The exposed spreadsheets included agent names, license numbers, roles within agencies, Social Security numbers and federal employment identification numbers. Agency names were also part of the exposed information in Covered California’s notice. The breach letter from Covered California officials said recipients’ information and information about other agents was disclosed.

Covered California’s sample breach notice appeared on the California attorney general’s website on October 16, 2026. The sample notice came about five months, or 156 days, after the May 13, 2026 incident. Covered California has not explained the roughly five-month gap between the incident and the notice posting.

The notice lacks a separate awareness date for Covered California beyond the May 13, 2026, incident date. The notice does not say whether the phishing scheme targeted Covered California staff, agents, or both.

The notice is addressed to insurance agents rather than health plan enrollees and omits consumer records or health information. It includes no credit monitoring or identity theft protection offer. The sample notice identifies no vendor, enrollment code or deadline.

Covered California has not disclosed how many agents the phishing incident affected. The organization has also not stated whether anyone misused the exposed information. Missing details include who was tricked, which system was reached, and how long access lasted.

Covered California provided no comment on the breach because its representative declined to speak. The organization says it is reviewing the incident’s scope and taking follow-up action. It is also strengthening security procedures and practices as part of its response.

Covered California operates California’s health insurance marketplace and provides Affordable Care Act public exchange services to state residents. Enrollment through the exchange covers 1.8 million California residents seeking individual or family health coverage. Employer plan coverage through the exchange reaches 9,819 employers and 80,951 employer plan enrollees.

A September report for the Covered California board says the exchange works with 12,749 agents and brokers. Open enrollment for 2027 coverage runs from November 1 through January 31.

The breach letter urges recipients to be alert for criminals trying to misuse the exposed information. The notice urges agents to set up fraud alerts with the three credit bureaus and remain alert for suspicious e-mails, calls and messages.

Emery Reddy says a name paired with a Social Security number can result in fresh credit lines and tax refund fraud. A scammer can use those details to pose as a licensed agent or send fake messages that appear to come from Covered California or a carrier.

Data security specialists warned in summer 2025 that insurers and benefits advisors should prepare for phishing-boosted ransomware attacks. The J&R Report says phishing actors stay active and keep targeting health insurance information.

In February, the Health Information Sharing and Analysis Center said health-related security incidents rose 55% in 2025 to 8,903. This phishing incident differs from an April 2025 issue where Covered California said LinkedIn tracking tags shared consumer website data.