Covered California, the state-run health insurance marketplace in California, has notified insurance agents that a phishing incident on May 13, 2026 exposed their personal information. A sample notice was filed with the California Attorney General on October 16, 2026.
Covered California’s Data Breach Investigation
Covered California is California’s state-run health insurance marketplace, headquartered in Sacramento. It is overseen by a board and an executive director and works with a network of licensed insurance agents who help residents enroll in coverage. According to a sample notice the organization filed with the California Attorney General, this incident involved information about those agents rather than about people who bought coverage through the marketplace.
The notice letter says that a phishing incident at Covered California on May 13, 2026 exposed the personal information of agents. It explains that Covered California learned an unauthorized individual had used a phishing scheme to gain access to information relating to agents, and that as a result the information of the recipient, along with that of other agents, was disclosed. This page reports those statements as the organization’s own account rather than as independently confirmed findings.
Phishing is a technique in which an attacker sends a message that appears to come from a trusted source in order to trick someone into giving up a password, opening a malicious link or handing over data. The notice does not say who was targeted, whose account or credentials were used, how the unauthorized individual obtained access, or how long that access lasted. It also does not say whether the information was copied or only viewed. Where a fact is not publicly available, this page says so rather than guessing.
The letter states that the unauthorized individual accessed agent spreadsheets. According to the notice, those spreadsheets included the agent’s name, agency name, license number, FEIN or Social Security number, and role within the agency. A FEIN is a federal employer identification number, which for a sole proprietor or small agency can be closely tied to a person’s own identity. Combining a name, a state license number and a Social Security number in one file is the type of data set that can be used to open accounts, file false tax returns or impersonate a licensed professional.
The notice does not say how many agents were affected, and the sources reviewed for this page do not publish a total. This page does not estimate one. The filed document is a template letter with bracketed placeholders for each recipient’s name, address and date, so it does not show when individual letters were mailed or emailed. The letter indicates that notices were sent by email to agents.
In response, Covered California says it regrets the incident and is taking actions to strengthen its security procedures and practices to minimize the risk of recurrence. It also says it is reviewing the scope of the incident and taking appropriate follow-up action. The letter does not offer credit monitoring or identity protection services. Instead, it recommends that recipients remain alert for suspicious emails, calls and other communications, review their records, and place a fraud alert on their credit files with the three major credit bureaus.
The letter also points recipients to a California Attorney General consumer resource titled Breach Help, and to the California Department of Justice privacy website. Questions are directed to a Covered California compliance or agent administration inbox rather than to a dedicated call center.
Because the exposed data reportedly includes licensing and business identification details, the risks reach beyond ordinary consumer fraud. Agents and agencies rely on their license numbers, FEINs and standing with carriers and regulators to do business. Someone holding those details may be able to attempt fraudulent business filings, falsify agency paperwork or craft convincing messages aimed at the agent’s own clients, who trust an agent they already know. Agents who received this notice may want to watch for unexpected carrier or marketplace account changes in addition to the usual credit steps.
The gap between the incident and the filing is also worth noting. The incident date given in the notice is May 13, 2026, and the sample was reported to the California Attorney General on October 16, 2026. Notification laws generally require organizations to notify affected people without unreasonable delay, and notice often follows an investigation into who was affected. Receiving a letter is not a finding about fault or about whether safeguards were adequate. Those questions remain open on the public record, and they are the kind of questions attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
Covered California’s notice states that the phishing incident occurred on May 13, 2026. The sample notice was reported to the California Attorney General on October 16, 2026. The sample is an undated template, so the date individual letters were sent is not shown.
If you received a letter, its own date and description are the most reliable record of the timeline for your information. The sources reviewed do not state when the organization discovered the incident.
What Information Was Breached?
The notice says the unauthorized individual accessed agent spreadsheets that included the recipient’s name, agency name, license number, FEIN or Social Security number, and role within the agency. Whether a given agent’s record held a FEIN or a Social Security number is not specified in the template.
The letter you receive should state which of your details were involved. Until then, it is prudent to treat your license number and tax identification numbers as potentially at risk.
What You Can Do
If you received a notice related to Covered California or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because the exposed data reportedly includes a license number and FEIN or Social Security number, consider an IRS Identity Protection PIN at irs.gov and watch for unexpected changes to your carrier or marketplace agent accounts.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Covered California
If you received a notice about this incident, or believe your personal or business identification information was exposed, you may have legal options. Organizations are expected to safeguard the sensitive information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
