Covered California

A May 13, 2026 phishing attack reached Covered California's internal spreadsheets of certified insurance agents: names, agency names, license numbers, roles, and Social Security numbers or FEINs. The filing names no count, no actor, and no account of whose credentials fell. It reached the California Attorney General roughly five months later. A registry of identity numbers kept as loose spreadsheets makes one phished login the entire security boundary.