Clover Health disclosed the data breach in a new financial filing, but few details about the incident are known.
The company said in a July 17 filing with the Securities and Exchange Commission that it discovered “unusual login activity on some of its information systems” on July 4. When the intrusion became apparent, Clover initiated response steps and contacted third-party experts to contain the threat.
“Subsequent investigation revealed that the attacker gained access to three accounts of non-management health plan members through social engineering,” Clover said in a written statement.
The company said these employees had access to brokerage sales functions and tools to schedule member visits. This does not include access to a company’s financial systems or insurance claims, but it does include access to potentially personal data and protected health information.
Clover said in its filing that details about the number of individuals who may have been affected are limited because “the investigation is ongoing into the exact nature, scope, and scope of the data that was subject to unauthorized access and acquisition.”
The insurer said it will make necessary regulatory disclosures and engage in necessary outreach to its members as the investigation continues. Clover added that it continues to “harden our IT environment.”
“We believe that by responding quickly, we were successful in containing and preventing the unauthorized access,” the filing said.
Clover also said in the filing that it does not believe the breach will have a material impact on its future operations or finances.
A Clover Health spokesperson told Fierce Healthcare, “The investigation is ongoing and we have limited information to share.”
A spokesperson said: “Protecting our members’ data remains our top priority and we take this matter seriously.”
Given the trove of data and aging technology available to healthcare organizations, they are prime targets for hackers and cybersecurity threats. The 2025 analysis found that the industry remains the top choice for hackers, with attacks continuing to rise through 2024, especially ransomware.
In 2024 in particular, a major cyberattack on UnitedHealth Group’s Change Healthcare division made headlines, with the company revealing that the hack ultimately affected 190 million people.
