Clover Health Investments, a Medicare Advantage plan provider, disclosed a data breach on July 17, 2026, via an 8-K filing with the SEC. The incident was discovered on July 4, 2026, and involved social engineering that compromised three non-managerial employee accounts responsible for visit scheduling and broker-facing sales. These accounts had access to personally identifiable information (PII) and protected health information (PHI).
The specific types of PII and PHI exposed have not been fully confirmed, and the total number of affected individuals has not been publicly disclosed. Financial systems were not accessed during the incident. Clover Health stated that it would make all required notifications once its investigation was complete, but a final count of notification recipients remains undisclosed.
Following the disclosure, multiple class-action lawsuits have been filed against Clover Health Investments, including Karwoski v. Clover Health Investments, Corp., Homan v. Clover Health Investments, Corp., Griffin v. Clover Health Investments, Corp., and Christian v. Clover Health Investments, Corp., all filed in the District Court, M.D. Tennessee. Details regarding the full scope of the breach and potential impact on individuals are still emerging as investigations proceed.