Clover Health Discloses Breach After Social Engineering Compromised Three Employee Accounts
Summary
Clover Health says a social engineering attack compromised three employee accounts with access to personal and health information. The company contained the incident, but its scope remains undetermined.
Key points
- Clover Health discovered the incident on July 4 and attributed it to a social engineering attack.
- Three non-managerial health plan employee accounts were compromised.
- The accounts had access to some personally identifiable and protected health information, but not corporate financial or claims systems.
- Clover Health says it activated its response plan, engaged cybersecurity experts, and believes it contained the incident and removed the attackers.
- The company has not determined the precise nature, scope, or extent of the breach and has not identified the threat actor.
Article Details
- Victim Organization
- Clover Health Investments
- Incident Type
- Social engineering attack that compromised three non-managerial health plan employee accounts, resulting in a data breach.
- Data Types Exposed
- Personally identifiable information
- Protected health information
- Affected Records
- Unknown; the company had not determined the precise scope of the breach.
- Operational Impact
- Three employee accounts were compromised. The company said the accounts had no access to corporate financial or claims systems. It believes it contained the incident and evicted the attackers, but had not determined the full scope.
- Ransom Or Extortion
- No known ransomware or extortion group had claimed responsibility. The source does not report a ransom demand.
- Claim Status
- confirmed