---
title: "Covered California agent phishing incident"
description: "Covered California reported that phishing exposed agent spreadsheets containing identity, licensing and tax information."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-20"
canonical_url: "https://www.ally.security/incidents/covered-california-agent-phishing-2026"
markdown_url: "https://www.ally.security/incidents/covered-california-agent-phishing-2026.md"
stix_url: "https://www.ally.security/incidents/covered-california-agent-phishing-2026/stix.json"
---

# Covered California agent phishing incident

A May 2026 phishing incident exposed information about Covered California agents.

Last modified Oct 20, 2026 · 2 sources

## Summary

- **Environment:** Covered California agent spreadsheets
- **Operational impact:** Agent information accessed and disclosed
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Covered California](https://www.coveredca.com/) reported that a May 13, 2026 phishing incident exposed agent information. An unauthorized individual used a phishing scheme to access agent spreadsheets, according to its [notice](https://oag.ca.gov/system/files/Agent%20Breach%20Letter%20Template_APPROVED.pdf). [1](#source-1)

## Impact

The spreadsheets included names, agency names, license numbers, agency roles, and federal employer identification numbers or Social Security numbers. The notice concerns agents; it does not establish a breach of health-plan enrollee records or provide a numerical total. [1](#source-1)

## Timeline

### May 13, 2026 — Agent information exposed

The notice dates the phishing incident to May 13. [1](#source-1)

### October 16, 2026 — California report recorded

The [registry](https://oag.ca.gov/privacy/databreach/list) recorded the report. The sample letter leaves its date blank. [2](#source-2)

### October 20, 2026 — Briefing updated

This briefing was last reviewed and updated on October 20, 2026.

## Threat Group & Attack Vector

The notice identifies phishing but does not establish a specific lure, exploit or compromised account. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Covered California said it was strengthening security procedures, reviewing the incident’s scope and taking follow-up action. A completed remediation date is not established. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/covered-california-agent-phishing-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Covered California agent phishing breach notice

official · Covered California

<https://oag.ca.gov/system/files/Agent%20Breach%20Letter%20Template_APPROVED.pdf>

<a id="source-2"></a>

### Data Security Breach List — 2026 records

regulatory · California Department of Justice, Office of the Attorney General

<https://oag.ca.gov/privacy/databreach/list>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: Accessed agent spreadsheets included names, agency names, license numbers, FEIN or Social Security numbers, and agency roles.
2. **Affected Organization · 100% confidence · current**  
   Covered California agent phishing incident: Covered California
3. **Occurred At · 100% confidence · current**  
   Agent information exposed in phishing incident: 2026-05-13
4. **Occurred At · 100% confidence · current**  
   California report recorded: 2026-10-16
5. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: Agent information exposed in phishing incident
6. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: California report recorded
7. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: Personal information described in the notification
8. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Tax identification numbers
9. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Names
10. **Occurred At · 100% confidence · current**  
   Covered California agent phishing incident: 2026-05-13
11. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: Covered California said it was strengthening security procedures, reviewing the incident scope and taking follow-up action.
12. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Social Security numbers
13. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Employment information
14. **Resulted In · 100% confidence · current**  
   Covered California agent phishing incident: An unauthorized individual used a phishing scheme to access and disclose information about Covered California agents.

</details>