Covered California Notifies Agents of Phishing Incident Exposing Personal Data

What happened

Covered California filed a notice with the California Attorney General, reported 2026-10-16, informing agents that their personal information was exposed in a phishing incident tied to the organization.

What information was involved

The notice describes the exposed records as agent spreadsheets containing identifying and licensing details used by Covered California.

What the notice says

Covered California describes the incident as resulting from a phishing scheme that reached agent-related records held by the organization. The organization states it is reviewing the scope of the incident and taking follow-up action, and it recommends that affected agents place fraud alerts with credit bureaus and watch for suspicious emails or calls.

What the notice leaves open

The notice as filed does not state the total number of agents affected by the Covered California incident. It also does not give a separate date on which Covered California first became aware of the phishing activity, beyond identifying May 13, 2026 as the date of the incident itself, and it does not describe whether the phishing scheme was directed at Covered California staff, agents, or both.