Loading story…
Clover Health Investments disclosed a data breach after a threat actor used social engineering to compromise three employee accounts, with anomalous login activity detected on July 4. The affected accounts belonged to non-managerial health plan staff involved in member visit scheduling and broker-facing sales support, and they had access to customers’ personally identifiable information and protected health information.
The company said the compromised employees did not have access to corporate financial or claims systems, and it believes the unauthorized access has been contained and the intruder removed after activating its incident response plan and engaging third-party cybersecurity experts. Clover said the investigation is ongoing, the full scope of accessed data and number of affected individuals have not yet been determined, no threat actor has been publicly identified, and required regulatory disclosures and member notifications will follow as needed.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Following discovery of the breach, Clover activated its incident response plan, engaged third-party cybersecurity experts, and said it contained and terminated the unauthorized access. The company stated the compromised accounts did not have access to corporate financial or claims systems.
In a 2026-07-17 SEC filing, Clover Health disclosed that the compromise of three employee accounts may have exposed members' personal information and protected health information. The company said its investigation was ongoing and that it would make required regulatory disclosures and notify affected members as necessary.
On 2026-07-04, Clover Health detected anomalous login activity and discovered that a threat actor had compromised three employee accounts through a social engineering attack. The affected employees were non-managerial staff involved in member visit scheduling and broker-facing sales support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CareCloud disclosed that a March intrusion into one of its AWS-hosted electronic health record environments exposed the data of **3,756,469 individuals**, sharply increasing the impact from earlier estimates of roughly 350,000. The company said attackers accessed the environment between **March 10 and March 16** after a disruption led to the discovery of the incident in mid-March, and that the compromised databases contained personal information, insurance details, and medical records. For a limited subset of affected individuals, the stolen data also included full payment card information, underscoring the severity of the breach for a healthcare technology provider serving more than 45,000 healthcare organizations. CareCloud said it engaged external cybersecurity experts, secured the affected environment, and reported no indication so far of misuse of the exposed data, while the U.S. Department of Health and Human Services confirmed the larger total on its healthcare breach tracker; no threat actor has been publicly identified, no group has claimed responsibility, and it remains unclear whether a ransom was demanded or paid.
Aug 24, 2026
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly **345,000 to 350,000** people in the United States. The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to **24 months** of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Aug 2, 2026
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected. Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
Sep 26, 2026