Security Guides

#data breach #phishing #Social Security number #insurance agents #California #United States

Covered California Agent Data Breach: Names, License Numbers and SSN or FEIN Exposed in a Phishing Incident, and What Agents Should Do

Covered California told agents that a phishing incident on May 13, 2026 exposed agent spreadsheets with names, license numbers and SSN or FEIN. What agents should do today, and what is still unknown.

Published 2026-10-30 Updated 2026-10-30 Last verified 2026-10-30 10 min read

On this page

For: licensed insurance agents, brokers and agency staff who work with Covered California, and the organisations that employ them. This article is based on Covered California's notice to agents as filed with the California Attorney General, and does not cover attack techniques.

Developing: this article will be updated as the organisation publishes more

As of October 30, 2026

Not yet known

Number of agents affected
How the access was gained and how long it lasted
Whether any consumer (enrollee) data was involved
Whether data was misused
Whether any support such as credit monitoring will be offered

Covered California says it is reviewing the scope of the incident and taking follow-up action, and that it is strengthening its security procedures. It has not said when it will publish more.

What agents and agency staff should do today

Check whether you received the notice

The notice on file is a template of a letter addressed to agents by email (the Attorney General calls it a sample notice, with placeholders for date and recipient), headed "Notice of Data Breach" and signed by Covered California's Privacy Officer. It says your information, along with information relating to other agents, was disclosed.

If you expected a notice and did not get one, the notice gives AgentContracts@Covered.Ca.Gov as the contact for questions. Covered California has not published a count, so we cannot say how many agents received it.

Place a fraud alert with the three credit bureaus

Covered California recommends placing a fraud alert on your credit files. A fraud alert tells lenders to take extra steps to verify your identity before opening a new account. The notice lists the bureaus: Equifax (800-525-6285, equifax.com), Experian (888-397-3742, experian.com) and TransUnion (800-680-7289, transunion.com).

Consider a credit freeze as well

This site's view: because an SSN may be among the items, a credit freeze is a stronger step than an alert. A freeze blocks most lenders from viewing your credit file, so a new account in your name is usually refused. In the United States it is free to place and lift at each bureau. Lift it temporarily when you apply for credit yourself.

If your FEIN was exposed, watch business-side accounts

The notice says "FEIN or Social Security number" and does not say which applies to whom. If you operate as a business and your FEIN was the item, check your business bank, tax and credit accounts for activity you did not start. If an SSN was the item, the personal steps above apply.

Review your records and report suspicious activity

The notice asks you to remain alert for suspicious emails, calls or other communications, to review your records and to report suspicious activity immediately. The California Attorney General's "Breach Help" consumer tips are enclosed with the notice, and the Department of Justice privacy page is oag.ca.gov/privacy.

Be careful with messages that mention your license or agency

Name, agency name, license number and role together let someone write a message that looks written for you, for example one that appears to come from agent administration or a carrier. Do not click links or open attachments in unexpected messages, and do not enter credentials. Check the sender, then reach Covered California through a contact you already trust (how to spot them: What is phishing?). If you reuse a password across work accounts, change it and turn on multi-factor authentication.

What happened (per Covered California)

The following is based on the notice template Covered California submitted to the California Attorney General, and on the Attorney General's breach listing.

May 13, 2026
Date of the phishing incident, per the Attorney General's listing and the notice.
October 16, 2026
Date the breach was reported to the California Attorney General, per its listing.
As of October 30
No follow-up notice found. The notice does not give the date it was sent to agents.

5 items

Name, agency, license no., FEIN/SSN, role

Not disclosed

Number of agents affected

None offered

Credit monitoring in the notice

What the notice says

Organisation: Covered California (California's health insurance marketplace)
What happened: An unauthorized individual used a phishing scheme to gain access to information relating to agents. Information about the recipient, along with other agents, was disclosed
Items in the spreadsheets: Name, agency name, license number, FEIN or Social Security number, and role within the agency
Actions taken: Strengthening security procedures and practices to reduce the risk of recurrence; reviewing the scope of the incident and taking follow-up action
Advice in the notice: Remain alert for suspicious communications, review records, report suspicious activity, place a fraud alert with the three credit bureaus, and follow the Attorney General's Breach Help tips
Contact: AgentContracts@Covered.Ca.Gov

What is known and what is not

Status as of October 30, 2026. When Covered California publishes more, we will update the status column.

Item	What the notice says	Status
Date of the incident	May 13, 2026	Confirmed (Covered California)
Report to the California Attorney General	October 16, 2026	Confirmed (Attorney General's listing)
Name, agency name, license number, role	Included in the spreadsheets	Confirmed (Covered California)
FEIN or Social Security number	Included; which applies to which agent is not stated	Confirmed (Covered California)
Method	Phishing scheme	Confirmed (details not disclosed)
Number of agents affected	Not stated	Under investigation
Consumer (enrollee) data	Not mentioned in the notice	Not stated
Misuse of the data	Not mentioned in the notice	Not stated
Credit monitoring or identity protection	Not offered in the notice	Not stated
Individual notification	The filed template is addressed to agents by email; the sending date and number of recipients are not stated	Template only (sending not stated)

How to read this: 'not mentioned' is not 'did not happen'

The notice covers agent information only. Consumer data not being mentioned is not a statement that none was involved, and Covered California says it is still reviewing the scope. Check the status column rather than assuming either way.

What these items can be used for

In general, the following combinations can be misused as described. This does not mean it has happened in this case.

SSN or FEIN with name: used to open credit accounts, file false tax returns or take over accounts in the victim's name
License number, agency name and role: lets someone write a convincing message to an agent that appears to come from a carrier, the marketplace or a licensing body
Agent identity details in general: can be used to try to impersonate an agent to consumers, which is a reason for consumers who work with an agent to confirm contact details independently

For organisations that keep staff or agent identifiers in spreadsheets

The notice says the exposed information was in spreadsheets and includes tax and identity numbers. It does not say how the access was gained beyond phishing, so this section does not assess Covered California's measures. These are general checks you can run on your own files.

Notice: SSN or FEIN sat in an agent spreadsheet

↓→

Do shared spreadsheets hold full identity numbers?

→ Search for 9-digit patterns; keep only the last 4 digits where possible

Notice: access started with a phishing scheme

↓→

Can one stolen sign-in open the file store?

→ Require phishing-resistant sign-in (passkeys) for accounts that reach such files

Notice: incident May 13, filed October 16

↓→

Do you know who holds which sensitive files?

→ Keep an inventory so scope can be answered quickly

Facts in this notice, and what an organisation can check on its own files (a general mapping)

Find full identity numbers in shared files

Search shared drives and mailboxes for nine-digit number patterns and for column names such as SSN, FEIN or tax ID. If a spreadsheet needs to identify a person, a masked value (last four digits) or an internal ID is usually enough.

Require sign-in that cannot be phished for accounts that reach those files

A password typed into a fake page can be reused by the person who collected it. Passkeys are tied to the real site, so a look-alike page cannot collect something usable. Start with the accounts that can open the most sensitive folders.

Keep an inventory of where sensitive files live

The ability to say quickly which files held which items, and who could open them, is what lets an organisation tell the people involved exactly what was exposed.

Sources (public record)

The facts in this article are based on the public information below. We do not speculate on undisclosed intrusion routes or techniques.

California Department of Justice, Office of the Attorney General, "Submitted Breach Notification Sample: Covered California" (date of breach May 13, 2026) — oag.ca.gov
Covered California, notice to agents "Notice of Data Breach" (sample letter filed with the Attorney General) — oag.ca.gov
California Department of Justice, Data Security Breach Reports listing (reported date October 16, 2026) — oag.ca.gov

Update history

2026-10-30: First version, based on the notice template filed with the California Attorney General and its breach listing (checked October 30). Covered California says it is reviewing the scope of the incident, and we will update this article when it publishes more.

Latest breaking reports

All breaking reports →

FAQ

QWhat was exposed in the Covered California breach?

According to Covered California's notice to agents, an unauthorized individual accessed agent spreadsheets that included the agent's name, agency name, license number, FEIN or Social Security number, and role within the agency. The notice does not say which of FEIN or Social Security number applies to which agent.

QAm I affected?

The notice is addressed to agents (licensed insurance agents who work with Covered California) and says information about agents, including the recipient, was disclosed. If you received the notice by email, treat yourself as affected. If you think you should have received it and did not, the notice lists AgentContracts@Covered.Ca.Gov for questions. Covered California has not published how many agents were notified.

QWere consumers or enrollees affected?

The notice describes information relating to agents only. It does not mention enrollee records, health information or consumer accounts. That is not a statement that no consumer data was involved; Covered California says it is still reviewing the scope of the incident.

QIs credit monitoring offered?

The notice we reviewed does not offer credit monitoring or identity protection services. It recommends placing a fraud alert on your credit files with Equifax, Experian and TransUnion and following the California Attorney General's Breach Help consumer tips.

QHow did the attacker get in?

The notice says only that an unauthorized individual used a phishing scheme to gain access to information relating to agents. It does not say which account or system was reached, how the access was gained beyond that, or how long it lasted.

QWhat if someone contacts me citing my license number or agency?

Treat it as suspect. The exposed items would let someone write a message that looks specific to you. Do not click links or open attachments, and do not give credentials or identity numbers. Contact Covered California through a number or address you already know, or the one in the notice, and check the sender before replying.