# Covered California Phishing Incident Exposes Licensed Insurance Agent Data (PII incl. SSN/FEIN)

> On May 13, 2026, an unauthorized individual used a phishing scheme to access information relating to Covered California agents. Exposed agent spreadsheets contained name, agency name, license number, FEIN or Social Security number, and role within the agency. Covered California reported the breach to the California Attorney General on October 16, 2026.

- **Published:** 2026-10-27T19:58:41Z
- **Last reviewed:** 2026-10-27T19:58:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4564
- **ID:** TL-2026-4564
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Covered California, the State of California's Affordable Care Act health insurance marketplace, disclosed a data security incident affecting licensed insurance agents (brokers and agency staff) who work with the exchange. According to the notice text summarized by OpenClassActions and the sample notice filed with the California Attorney General (record sb24-631490), Covered California learned that on May 13, 2026 'an unauthorized individual used a phishing scheme to gain access to information relating to agents.'

The exposed material consisted of agent spreadsheets containing the agent's name, agency name, license number, Federal Employer Identification Number (FEIN) or Social Security number, and the agent's role within the agency. No consumer enrollment records or health information were reported as involved. The number of affected agents has not been published.

Covered California reported the incident to the California Attorney General on October 16, 2026, roughly five months after the May 13 event, and notified affected agents by email (the notice template was filed as 'Agent Breach Letter Template_APPROVED.pdf', signed by the agency Privacy Officer). The notice points recipients to fraud-alert instructions for the three credit bureaus and the California Attorney General's Breach Help consumer tips. Covered California stated it is reviewing the scope of the incident and strengthening security procedures. No free credit monitoring or identity protection was offered. As of October 20, 2026 no lawsuit or settlement was reported.

Evidence limits: the sources do not describe the phishing lure, delivery channel, targeted account, whether credentials were harvested, the dwell time, the threat actor, or any infrastructure. No malware, CVE or network indicators have been published. The MITRE mapping below is therefore limited to techniques directly implied by the disclosed facts (phishing as the access method, unauthorized access to stored agent spreadsheets); account use and the information-gathering mappings are inferences from the disclosure wording, not confirmed details. Because SSN/FEIN plus license numbers and roles are exposed, affected agents face elevated risk of identity theft, tax and business-identity fraud, and follow-on spear-phishing that impersonates the exchange or carriers. The IOCs listed are reference artifacts and data-class indicators for defenders and are NOT adversary infrastructure.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1598 Phishing for Information

## Sources

- [Covered California Data Breach Notice 2026 (OpenClassActions)](https://openclassactions.com/news/data-breaches/covered-california-data-breach-notice-2026.php)
- [California Attorney General - Covered California breach report sb24-631490](https://oag.ca.gov/ecrime/databreach/reports/sb24-631490)
- [Covered California Agent Breach Letter Template (filed with the California AG)](https://oag.ca.gov/system/files/Agent%20Breach%20Letter%20Template_APPROVED.pdf)
- [California Attorney General - Data Security Breach Reports list](https://oag.ca.gov/privacy/databreach/list)
- [Notice of Covered California Security Alert (FHCSD) - earlier, separate 2024 phishing alert, background only](https://www.fhcsd.org/notice-of-covered-california-security-alert)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4564