Clover Health data breach: three employee accounts taken over by social engineering

What happened at Clover Health?

Clover says it started its incident response, brought in outside cybersecurity experts, contained the activity and notified law enforcement. Its preliminary findings were that the three accounts belonged to employees who handled member visit scheduling and broker-facing sales. It said its quick response contained and ended the access.

Date	What the filings and the HHS record say
July 4, 2026	Clover becomes aware of anomalous login activity
July 17, 2026	Form 8-K, Item 8.01
August 7, 2026	Q2 10-Q repeats the account; investigation still ongoing
September 14, 2026	Report to HHS: 138,677 people, as a health plan

Clover filed under Item 8.01 rather than Item 1.05, and said it did not believe the incident had had, or was reasonably likely to have, a material impact. The Item 8.01 versus Item 1.05 guide explains the difference, and the social engineering guide compares other filings where attackers talked their way in.

What information was involved?

The 8-K says the accounts had access to certain personally identifiable information and protected health information. It does not list the data elements. The Q2 10-Q, filed August 7, says the investigation was still ongoing and the scope of data accessed or taken had not been fully determined.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	138,677

The HHS report came two months after the 8-K. Neither SEC filing gives a count.

Did Clover Health notify members?

The 8-K said Clover would make every required notification, including to affected members, once it had its findings. Its HHS report followed on September 14, 2026.

What the documents leave open

• Which data elements the attacker reached, and for how many of the 138,677 members.
• How the social engineering worked: phone, email or another route.
• What Clover offers members who receive a letter.