Clover Health Investments, Corp. — the Medicare Advantage issuer traded as CLOV — told the SEC that on July 4, 2026 it saw anomalous logins, then found that a threat actor reached three non-managerial health-plan employee accounts through social engineering. The Item 8.01 Form 8-K, filed July 17, says those accounts handled member visit-scheduling and broker-facing sales.
This is a confirmed incident, not ransomware. Clover said the accounts had personally identifiable information and protected health information, and no access to corporate financial or claims systems. It notified law enforcement, said the access was contained, and told investors it did not expect a material impact. That is why the box is 8.01 (Other Events), not Item 1.05.
HHS OCR later listed Clover Health as a health plan for 138,677 individuals (submission September 14, 2026; hacking / IT incident). SecurityWeek (October 5) reported names, dates of birth, insurance identifiers, and account IDs. The 8-K itself did not publish a headcount.
The 8-K describes Clover as remote-first (stockholder mail: secretary@cloverhealth.com). Press copy often says Jersey City, New Jersey. OCR’s portal row uses Minnesota for the plan entity. We do not invent a Texas OAG count. A same-week AngMar / Interlock notice is a different Texas home-health victim.
Snapshot
| Field | Detail |
|---|---|
| Company | Clover Health Investments, Corp. (NASDAQ: CLOV) |
| Earliest event | July 4, 2026 · filed July 17 as Item 8.01 |
| Path | Social engineering of three non-managerial accounts |
| Individuals | HHS OCR 138,677 (Sep 14) · no Texas OAG row found |
What Clover told the SEC
The company activated incident response, hired outside cybersecurity help, and says it contained and terminated the access. Investigation into the exact data set was still open on the filing date. Clover said it would make required member notifications based on those findings.
SecurityWeek’s later data-type list matches a health-plan scheduling / broker desk: identity plus insurance and account numbers. That is press detail, not a second 8-K. Do not read the missing Item 1.05 box as “nothing happened” — Clover already told investors PII/PHI sat in those three accounts.
CourtListener — Middle District of Tennessee
Putative class actions landed within weeks of the 8-K. The lead RECAP caption is a consolidated-style title:
| Case | Docket | Filed |
|---|---|---|
| In re Clover Health Data Breach | 3:26-cv-01035 | Jul 22, 2026 |
| Homan v. Clover Health | 3:26-cv-01047 | Jul 23, 2026 |
| Griffin v. Clover Health | 3:26-cv-01049 | Jul 23, 2026 |
| Karwoski v. Clover Health | 3:26-cv-01054 | Jul 24, 2026 |
Court: M.D. Tennessee. The In re row is tagged diversity / breach of contract and personal injury. Filings are allegations, not a verdict on the 138,677 figure.
What members should do
- Type cloverhealth.com or my.cloverhealth.com/login/. Do not use a “Clover settlement / restore your ID card” link from email or text.
- Watch for official member mail. Until it arrives, treat “pay to suppress your CLOV file” messages as unverified.
- Freeze credit and review EOBs and broker-of-record letters if you are a Clover member or used a Clover-facing broker desk.
- Employees and brokers: reset work passwords on a host you typed. Social engineering of three accounts is enough to clone a help-desk callback.
- Nationwide reports: IC3. Texas residents can still check the OAG breach portal even though we have not found a Clover row there.
MFA: YubiKey and Google Authenticator
Clover’s own story is social engineering of employee accounts. A member-portal second factor does not rewind July 4. It does blunt the “verify your My Clover / insurance ID” phishing that follows an HHS headline. Grades match our MFA directory.
| Grade | Meaning |
|---|---|
| Fail | SMS, voice, or email OTP — or no public path |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| My Clover (member) | Fail | No | No |
| Clover workforce | Unevaluated | — | — |
Clover’s My Clover 2FA help (updated October 1, 2026) documents a code by email or SMS after password sign-in at my.cloverhealth.com. That is Fail — email OTP remains. The page does not name a YubiKey or Google Authenticator. This is the health-plan portal, not Fiserv’s Clover POS / developer dashboard (a different company). Public workforce-MFA docs were not found.
Directory: MFA support directory · Category → Healthcare.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited Clover, the SEC filing host, SecurityWeek, and HIPAA Journal on October 11, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not reconstruct the social-engineering call.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| U.S. SEC | sec.gov | 88% | −12 |
| SecurityWeek | securityweek.com | 71% | −29 |
| HIPAA Journal | hipaajournal.com | 56% | −44 |
| Clover Health | cloverhealth.com | 54% | −46 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| sec.gov | 90% | 45% | 98% |
| securityweek.com | 65% | 80% | 70% |
| hipaajournal.com | 35% | 15% | 70% |
| cloverhealth.com | 50% | 15% | 43% |
Audit links: cloverhealth.com · sec.gov · securityweek.com · hipaajournal.com
Clover Transport 15% and Identity 50% mean a spoofed “My Clover verification / broker roster” message is easier to land than the 54% overall implies. sec.gov is the filing host, not the victim.
Website stack note
Passive website-tech probes on October 11, 2026:
| Domain | Stack signal |
|---|---|
| cloverhealth.com | Stack undetected; GoDaddy TLS expires 2027-04-21 |
| sec.gov | Drupal (version hidden); DigiCert TLS expires 2027-03-02 |
| securityweek.com | Stack undetected; Let’s Encrypt TLS expires 2027-01-05 |
| hipaajournal.com | Stack undetected; Let’s Encrypt TLS expires 2027-01-02 |
Point-in-time only. A marketing homepage is not a forensic finding on the three employee accounts.
Blacklist and lookalike domains
Email blacklist checks (public DoH, October 11, 2026): cloverhealth.com, sec.gov, securityweek.com, and hipaajournal.com were clear on mail/domain lists we can query. A Clover web/CDN Spamhaus ZEN note and SecurityWeek / HIPAA Journal SPFBL web notes are informational — not mail-reputation hits.
DNS lookalike scans (BEC profile, registered signals only):
| Brand scanned | To review | Likely owned | BEC staging |
|---|---|---|---|
| cloverhealth.com | 6 | 0 | 0 |
| sec.gov | 13 | 0 | 1 |
| securityweek.com | 8 | 3 | 0 |
| hipaajournal.com | 1 | 0 | 0 |
High-interest registered names (investigate; not proof this incident used them):
| Lookalike | Technique | Note |
|---|---|---|
| acloverhealth.com | insertion | Live A |
| cloverhealth.ai / .co / .net | tld-swap | Live DNS on the brand |
| sec.cloud | tld-swap | BEC staging (NS + MX) |
| sec.com | tld-swap | Not the .gov Commission |
securityweek.ai / .co / .io redirected to the real news host when we checked. Type cloverhealth.com and my.cloverhealth.com/login/. Continuous monitoring: Cybersquat Domain Monitoring.
Related coverage
- AngMar / Interlock home-health notice (same-week SecurityWeek pair; Mansfield, TX)
- SEC 8-K cyber week of Jul 17
- SEC Item 1.05 YTD (Jul 2026)
- Major U.S. healthcare payers email security
- McKesson vishing / N.D. Tex. lawsuits
- MFA support directory
Run a free audit at audit.emailmenow.com or contact EmailMeNow for health-plan DMARC / MTA-STS and phishing response aimed at the 100% ideal.