Summary
- Environment: Covered California agent spreadsheets
- Operational impact: Agent information accessed and disclosed
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 20, 2026; updated as evidence emerges.
What happened
Covered California reported that a May 13, 2026 phishing incident exposed agent information. An unauthorized individual used a phishing scheme to access agent spreadsheets, according to its notice. [1]
Impact
The spreadsheets included names, agency names, license numbers, agency roles, and federal employer identification numbers or Social Security numbers. The notice concerns agents; it does not establish a breach of health-plan enrollee records or provide a numerical total. [1]
Timeline
Threat Group & Attack Vector
The notice identifies phishing but does not establish a specific lure, exploit or compromised account. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Covered California said it was strengthening security procedures, reviewing the incident’s scope and taking follow-up action. A completed remediation date is not established. [1]