A social engineering attack targeted Clover Health Investments, compromising three employee accounts with access to personal and health information of customers. The affected accounts were used for member visit scheduling and broker-facing sales functions. Clover Health detected the breach on July 4, 2026, and responded immediately by activating its incident response plan and involving external cybersecurity experts. The compromised accounts did not have access to corporate financial or claims systems. The company believes the attackers were evicted and the incident contained but has not yet determined the precise extent of the data breach. No known ransomware or extortion groups have claimed responsibility, and no further attribution information is available.

The breach exposed personally identifiable information (PII) and protected health information (PHI) of Clover Health customers. Although financial and claims systems were not accessed, the exposure of health and personal data can lead to privacy violations and potential misuse of sensitive information. The full impact is still under investigation as the company has not yet determined the exact scope of the data compromised.

Clover Health has activated its incident response plan and engaged third-party cybersecurity experts to contain and investigate the breach. The company believes it has contained the incident and removed the attackers from its systems. No additional mitigation steps are specified at this time. Patch status is not applicable as this is a social engineering attack rather than a software vulnerability. Organizations should continue monitoring for updates from Clover Health for any further remediation guidance.