2026 Covered California — phishing incident exposed agent spreadsheets with names, licence numbers and SSNs
Data compromised
Agent spreadsheets containing name, agency name, licence number, FEIN or Social Security number, and role within the agency.
Technical writeup
Notification letter filed with the California Attorney General (Oct 16, 2026), dated for a phishing incident on May 13, 2026. Covered California is the state’s health insurance marketplace. The company says it is reviewing the scope of the incident. The AG page notes a sample template; treat the scope as provisional. recordsAffected 0 (count not listed).
Root cause
An unauthorised individual used a phishing scheme to reach agent-related information.