Clover Health Data Breach

On July 22, 2026, Clover Health Investments Corp., a publicly traded Medicare Advantage insurer operating in 11 states, disclosed in an SEC filing that it is investigating a social-engineering incident involving unauthorized access to three employee email accounts. Clover Health says it first identified unusual login activity on July 4, 2026. The affected accounts belonged to non-managerial staff working in member scheduling and broker sales.

According to Clover Health’s own statement, the compromised accounts had access to some personal and protected health information, though the company has not yet confirmed whether any data was actually accessed or exfiltrated, and has not disclosed which specific data fields or how many individuals may be involved. Clover Health has stated the incident did not reach its corporate financial or claims systems.

Why This Matters

This is a rapidly developing situation. Clover Health is a publicly traded company with SEC disclosure obligations, and its investigation into this incident is still ongoing; the company itself has not yet said whether any member data was actually taken, only that the compromised accounts had the ability to access it. That uncertainty is exactly why it’s worth getting ahead of the situation: if Clover Health’s investigation later confirms that member data was exfiltrated, having already documented your concerns now may help.

Clover Health has not disclosed a total number of members potentially affected, and has not yet released a full list of the data types involved.

What Information Was Exposed?

Clover Health has not confirmed whether any personal or protected health information was actually accessed or exfiltrated in this incident, and has not disclosed a specific list of data types or an affected population count. What we know from the company’s own disclosure is that the three compromised employee accounts had the ability to access some personal and protected health information belonging to Clover Health members.

What Is Clover Health Offering Affected Individuals?

Clover Health has not yet announced any credit monitoring, identity protection, or other remedy in connection with this incident. If you’re a Clover Health member and receive a communication from the company about this incident, review it carefully.

Your Information Is at Risk

Even without confirmed data exfiltration, unauthorized access to systems containing protected health information is a serious event. If member data was accessed, it could include the kind of personal and health information that’s frequently used in insurance fraud, phishing schemes, and identity theft. Affected individuals should:

• Watch for phishing emails, calls, or texts that reference Clover Health, your coverage, or your health plan
• Review your Explanation of Benefits (EOB) statements for unfamiliar claims or providers
• Save any communication you receive from Clover Health about this incident
• Monitor your credit reports and consider a fraud alert if you’re concerned
• Contact Emery | Reddy for a Free Case Review even before a formal notice is issued

Do You Have Legal Options?

Health insurers that collect and store protected health information have a legal obligation to safeguard it. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many Clover Health members were affected?

Clover Health has not disclosed a population figure. The company has not yet confirmed whether any member data was actually exfiltrated.

What information was exposed?

Clover Health has not confirmed a specific list of data types. The company has said the three compromised employee accounts had the ability to access some personal and protected health information belonging to members.

Has Clover Health confirmed my data was accessed?

Not at this stage. Clover Health disclosed the incident on July 22, 2026, roughly 18 days after first identifying unusual login activity, and says its investigation is ongoing.

What should I do right now?

Save any communications from Clover Health, watch your EOB statements and accounts for anything unfamiliar, and consider contacting us for a free case review so your concerns are documented early.