Clover Health

Summary

Clover Health discovered anomalous login activity on certain information systems and found that a threat actor gained access to three non‑managerial health plan employee accounts through social engineering. The compromised accounts were used for broker‑facing sales and member visit scheduling, providing access to personal and protected health information but not to corporate financial or claims systems. The company activated its response plan, engaged third‑party experts, contained the intrusion and believes the unauthorized access was terminated. Investigation into the exact scope of data accessed is ongoing, and the company states it does not expect the breach to materially affect its operations or finances while continuing to harden its IT environment.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 4, Clover Health Investments discovered anomalous login activity on certain of its information systems. The discovery was reported in a securities filing with the Securities and Exchange Commission submitted on July 17. The investigation showed that a threat actor gained access to three non‑managerial health plan employee accounts through social engineering. Those employees were assigned to broker‑facing sales functions and tools for scheduling member visits. The compromised accounts provided access to certain personally identifiable information and protected health information. The accounts did not have access to corporate financial systems or claims processing platforms.

Upon discovering the intrusion, Clover Health activated its incident response procedures and engaged third‑party cybersecurity experts to contain and investigate the threat. The company stated that it believes its rapid response successfully contained and terminated the unauthorized access. Clover Health indicated that the investigation is ongoing into the precise nature, scope, and extent of data that was subject to unauthorized access and acquisition. As a result, details on how many individuals may have been impacted remain limited. The insurer said it will make any necessary regulatory disclosures and conduct required outreach to members as the investigation continues. Clover Health also noted that it continues to harden its IT environment.

The company has not disclosed any information about the threat actor behind the attack. No known ransomware or extortion group has claimed responsibility for the incident. Clover Health Investments, founded in 2014, provides Medicare Advantage insurance plans and operates as a direct United States government contractor. In its filing, the company said it does not believe the breach will materially impact its business operations or finances moving forward. A spokesperson told media outlets that protecting members’ data remains the highest priority and that the matter is being taken seriously.

Sources

Sources available to members: 2 sources.