Clover Health Investments, Corp., a Medicare Advantage plan insurer, has disclosed a security incident in which a threat actor gained access to employee accounts that had visibility into members’ personal and health information.
Health insurers handle some of the most sensitive information a person has, and members trust companies like Clover Health to keep that data protected from unauthorized access.
Clover Health’s Data Breach Investigation
In a Form 8-K filed with the U.S. Securities and Exchange Commission, Clover Health Investments, Corp. disclosed that on July 4, 2026, it became aware of anomalous login activity affecting certain of its information systems. The company activated its incident response procedures, engaged third-party cybersecurity experts, and notified law enforcement. According to the filing, the investigation determined that a threat actor gained access to the accounts of three non-managerial health plan employees through social engineering, a tactic in which attackers manipulate individuals into granting access rather than exploiting a technical vulnerability directly. The affected employee accounts were tied to visit-scheduling and broker-facing sales functions and had access to certain personally identifiable information and protected health information, though the company stated the accounts did not have access to corporate financial or claims systems. As of its SEC filing, Clover Health said the full nature, scope, and extent of the data subject to unauthorized access remained under investigation, and that it would make all required notifications to affected members once that review is complete.
Health insurers and other companies that manage Medicare Advantage plans are frequent targets for cyberattacks because of the volume and sensitivity of the information they hold, including Social Security numbers, dates of birth, medical histories, and insurance identifiers. Social engineering attacks, like the one described in Clover Health’s filing, are particularly common in the healthcare and insurance sectors because they target employees directly rather than relying on exploiting a software vulnerability, and can be difficult to prevent through technical safeguards alone.
When health plan employee accounts with visit-scheduling and sales functions are compromised, the data those employees can typically access, such as member names, contact information, dates of birth, and plan or health details, can be used by criminals for a range of fraudulent purposes, including identity theft, insurance fraud, and targeted phishing campaigns against members. Even where a company states that core financial or claims systems were not accessed, exposure of identifying and health-related information alone can still cause real harm to affected individuals.
Public companies like Clover Health are required to disclose material cybersecurity incidents to the SEC under current disclosure rules, which is why details of this incident became public through a Form 8-K filing rather than only through direct notifications to members. That regulatory filing occurred before the company completed its investigation into the full scope of affected data, which is a common sequence for incidents involving publicly traded companies. Members should expect that additional information, including individual notifications, may follow as Clover Health’s investigation progresses.
In the meantime, members affected by any health insurer data breach should be alert to follow-up phishing attempts, which often increase after news of a breach becomes public, as scammers impersonate the affected company or credit monitoring services in an attempt to obtain further personal information.
When Did This Breach Occur?
Clover Health first became aware of anomalous login activity on July 4, 2026. The company disclosed the incident publicly in a Form 8-K filed with the SEC, signed and dated July 17, 2026. Clover Health has not yet disclosed when member notifications will be sent or the specific timeframe during which the threat actor had access to the compromised employee accounts.
What Information Was Breached?
According to Clover Health’s SEC filing, the compromised employee accounts had access to personally identifiable information and protected health information belonging to plan members, though the company has not yet specified the exact categories of data involved, such as Social Security numbers, dates of birth, or medical record details. Clover Health stated that the accounts did not have access to corporate financial or claims systems. The company says it continues to investigate the full scope of affected data and will make required notifications once that assessment is complete.
What You Can Do
If you are a Clover Health member, consider taking the following precautions while the company’s investigation continues:
- Watch for an official notification letter from Clover Health and read it carefully once received
- Monitor your health insurance statements and explanation-of-benefits notices for unfamiliar activity
- Be cautious of unsolicited calls, texts, or emails referencing this breach, especially those asking for personal or financial information
- Consider placing a fraud alert or credit freeze with the major credit bureaus as a precaution
- Keep records of any suspicious account activity or communications related to your Clover Health membership
File a Data Breach Lawsuit Against Clover Health
If you are a Clover Health member and are concerned your personal or health information may have been exposed in this incident, you may have legal options. Attorneys are investigating whether Clover Health took adequate steps to secure member data and whether affected individuals may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
