Licensed insurance agents who work with Covered California were notified of a May 13, 2026 phishing incident that exposed agent spreadsheets containing names, agency names, license numbers, FEINs or Social Security numbers, and roles. Covered California has not published how many agents were affected, and there is no lawsuit or anything to claim.
Allegations Only · No Settlement Yet
This article describes a data breach notice. Covered California has not been found liable for the incident, no lawsuit or settlement exists, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Covered California?
Covered California, the state agency that runs California’s health insurance marketplace under the Affordable Care Act, reported a data breach to the California Attorney General on October 16, 2026. The listing gives the date of the breach as May 13, 2026. According to the sample notice letter posted with the listing, “an unauthorized individual used a phishing scheme to gain access to information relating to agents.”The letter is addressed to licensed insurance agents, the brokers and agency staff who help consumers enroll in Covered California plans, and was sent to them by email. It says the information involved was in “agent spreadsheets that included your name, agency name, license number, FEIN or Social Security number, and role within the agency.” The letter does not name an outside vendor; it describes the phishing incident as occurring at Covered California.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Were Covered California Enrollees Affected?
The notice posted with the California Attorney General is written to insurance agents about agent information. It does not describe consumer enrollment records or health information being involved. Covered California has not published a count of the people affected, and no matching filing was found on the Texas Attorney General’s breach portal or in Massachusetts’ 2026 breach report.This incident is separate from the proposed class action over tracking tools on the CoveredCA.com website. In that case, Doe v. LinkedIn Corp. in federal court in San Jose, plaintiffs allege that LinkedIn and Google trackers on the site sent applicants’ health-application answers to those companies; according to news reports, the trackers ran from about February 2024 until early April 2025; LinkedIn and Google, not Covered California, are the defendants there. OCA covers that case on its Covered California tracking lawsuit page.
What Is Covered California Offering?
The sample letter does not offer free credit monitoring or identity protection. It describes the fraud alert that can be placed with the three credit bureaus and includes the California Attorney General’s “Breach Help” consumer tips. Covered California says it is reviewing the scope of the incident and strengthening its security procedures and practices.Has a Lawsuit Been Filed?
No lawsuit or law firm investigation tied to the May 2026 phishing incident had been found as of October 20, 2026. Covered California is a state agency, and claims against public entities in California generally follow different procedures than claims against private companies.Questions
What happened in the Covered California data breach?
Covered California reported to the California Attorney General on October 16, 2026 that a phishing incident on May 13, 2026 let an unauthorized person access information about insurance agents, including spreadsheets with agents’ names, agency names, license numbers, FEINs or Social Security numbers, and roles.
Were Covered California enrollees affected by the breach?
The notice filed with the California Attorney General is addressed to licensed insurance agents and describes agent information. It does not describe consumer enrollment or health records being involved, and Covered California has not published a count of the people affected.
Is the Covered California breach related to the LinkedIn tracking lawsuit?
No. The tracking lawsuit, Doe v. LinkedIn Corp., alleges that LinkedIn and Google trackers on CoveredCA.com sent applicants’ health-application answers to those companies; news reports date the trackers to about February 2024 through early April 2025. The 2026 incident is a separate phishing breach involving insurance agents’ information.
Is there a Covered California data breach settlement?
No. As of October 20, 2026, no lawsuit over the May 2026 phishing incident had been found and no settlement exists, so there is nothing to claim.
Sources
• California Attorney General breach listing — Covered California (breach date May 13, 2026; reported October 16, 2026) and the sample agent notice letter posted with it• Texas Attorney General Data Security Breach Reports portal and Massachusetts 2026 Data Breach Notification Report (no matching Covered California entry as of October 20, 2026)
• Doe v. LinkedIn Corp., No. 5:25-cv-03737 (N.D. Cal.), for the separate tracking lawsuit
