Covered California Data Breach

A phishing attack at Covered California exposed spreadsheets of insurance agent records. For some agents, those records included a Social Security number.

Covered California runs the state’s health insurance marketplace. It also works with a network of certified insurance agents who help consumers enroll in plans. According to a Notice of Data Breach that Covered California filed with the California Attorney General, a phishing incident on May 13, 2026 exposed personal information about those agents.

Phishing is a scam in which someone sends a fake email or message that looks real to trick a person into handing over a password or other access. According to the notice, an unauthorized individual used a phishing scheme to gain access to information relating to agents. The person accessed agent spreadsheets. The notice says the information of the letter’s recipient was disclosed along with information relating to other agents.

How the Breach Happened and What Covered California Has Said

Covered California’s notice is short on detail. It does not say who was tricked by the phishing email, which system the attacker reached, or how long the attacker had access. It also does not say whether anyone has misused the data. Covered California states that it is taking actions to strengthen its security procedures and practices. It also says it is reviewing the scope of the incident and taking appropriate follow-up action.

The notice is addressed to agents, not to health plan enrollees. It does not mention consumer records or health information. Readers who are Covered California enrollees should check whether they received a letter of their own before assuming they were affected.

Five Months Between the Incident and the State Filing

The incident took place on May 13, 2026. The California Attorney General’s office posted Covered California’s sample notice on October 16, 2026. That is about five months (156 days) later. The sample letter leaves its own date blank, so the exact date agents received notice is not public. Covered California has not explained the timing.

Covered California has not disclosed the total number of agents affected. The Attorney General’s listing does not give a count either.

What Information Was Exposed?

Based on the official notice, the agent spreadsheets included:

• Name
• Agency name
• License number
• FEIN (Federal Employer Identification Number, a business tax ID) or Social Security number
• Role within the agency

What Is Covered California Offering Affected Agents?

The sample notice does not offer credit monitoring or identity theft protection. It names no vendor, enrollment code or deadline. Instead, it recommends that agents place a fraud alert with the three credit bureaus and stay alert for suspicious emails, calls and other messages. It also encloses the California Attorney General’s Breach Help consumer tips. Agents with questions can reach Covered California at [email protected].

Your Information Is at Risk

This combination of data is valuable to criminals. A Social Security number paired with a name can open the door to new credit accounts and tax refund fraud. A license number and agency name add a second layer of risk. A scammer can use them to pose as a licensed agent, or to send convincing fake messages that seem to come from Covered California or a carrier. Agents who handle consumer enrollments face an added risk that criminals will target their clients through them.

Affected agents should consider these steps:

• Place a fraud alert or a free credit freeze with Equifax, Experian and TransUnion.
• Pull free credit reports and look for accounts you did not open.
• File an IRS Identity Protection PIN request to help block fake tax returns.
• Treat any email, call or text about this incident with caution, and log in only through official websites.
• Watch for misuse of your license number and report it to the California Department of Insurance.

Do You Have Legal Options?

Organizations that collect Social Security numbers, tax IDs and license data have a legal obligation to safeguard it. When that obligation is not met, affected individuals may have legal rights and remedies worth exploring.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. Call 206.207.8929. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

FAQ

How many people were affected by the Covered California data breach?

Covered California has not disclosed a total. Its filing with the California Attorney General does not include a count.

Who was affected?

The notice is addressed to insurance agents who work with Covered California. It does not mention health plan enrollees or consumers.

What information was exposed in the breach?

According to the notice, the agent spreadsheets included:

• Name
• Agency name
• License number
• FEIN or Social Security number
• Role within the agency

Why did it take so long for Covered California to notify people?

The incident happened on May 13, 2026. The Attorney General posted the sample notice on October 16, 2026, about five months later. Covered California has not explained the gap.

Is this the same as the 2025 LinkedIn tracking issue?

No. In April 2025, Covered California said LinkedIn tracking tags on its website had shared some consumer data. That was a separate matter involving website visitors. The May 2026 incident is a phishing attack involving agent records.

What should I do if I received a notification letter?

Keep your letter. Then:

• Place a fraud alert or credit freeze with all three bureaus.
• Check your credit reports often.
• Ask the IRS for an Identity Protection PIN.
• Be wary of any message that mentions this incident.

How can I protect myself from scams that mention this breach?

Criminals often follow a breach with fake messages that reference it by name. Do not click links or call numbers in an unexpected message. Contact the organization through a website or phone number you look up yourself.

Do I have a legal claim?

Organizations that hold Social Security numbers and other personal data have a duty to protect it and to tell people promptly when it is exposed. If you received a Covered California breach letter, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.