Clover Health Data Breach Class Action: What Members Should Know Featured
Employee accounts with access to members’ personal and protected health information were compromised in a social-engineering attack.
Clover Health Investments, Corp. is facing scrutiny after disclosing a cybersecurity incident involving unauthorized access to employee accounts that could access members’ personal and health information. A proposed class action lawsuit has now been filed, and affected Clover Health members may have legal rights.
What Happened in the Clover Health Data Breach?
Clover Health reported that it discovered anomalous login activity on July 4, 2026. Its investigation determined that a threat actor gained access to three non-managerial health plan employee accounts through social engineering. The accounts belonged to employees who worked in member visit scheduling and broker-facing sales.
Clover Health stated that it activated its incident-response procedures, retained third-party cybersecurity experts, took steps to contain the activity, and notified law enforcement. The company believes the unauthorized access was terminated, but its investigation into the precise scope of the incident remains ongoing.
What Information May Have Been Exposed?
According to Clover Health’s SEC filing, the compromised accounts had access to certain personally identifiable information and protected health information. The company stated that the accounts did not have access to corporate financial or claims systems.
Clover Health has not publicly identified every category of information involved or the total number of affected individuals. The information exposed may therefore vary from person to person. Members should carefully review any notice they receive because it may identify the specific data involved.
Why Does This Breach Matter?
Personal and health information can potentially be used for identity theft, targeted phishing, insurance fraud, or medical identity theft. The U.S. Department of Health and Human Services explains that medical identity theft may involve misuse of a person’s name, Social Security number, or Medicare number to submit fraudulent healthcare claims.
Affected members should be cautious about unexpected emails, text messages, or telephone calls that appear to come from Clover Health, Medicare, a healthcare provider, or a credit-monitoring service.
Has a Clover Health Data Breach Class Action Been Filed?
A proposed class action lawsuit, Homan v. Clover Health Investments, Corp., was filed on July 23, 2026, in the U.S. District Court for the Middle District of Tennessee. The case is at an early stage, and the allegations have not been proven in court.
Eligibility may depend on whether a person’s information was accessed, what information was involved, and whether the person experienced losses, fraud, increased risk, or other harm.
What Should Clover Health Members Do?
Members should:
- Keep any breach notification letter or related correspondence.
- Review Medicare statements and explanations of benefits for unfamiliar activity.
- Monitor financial accounts and credit reports.
- Preserve records of suspicious communications, fraudulent activity, expenses, or other losses.
- Consider placing a free fraud alert or credit freeze.
The Federal Trade Commission recommends reviewing credit reports, considering a fraud alert or credit freeze, accepting legitimate credit-monitoring services when offered, and using IdentityTheft.gov if personal information is misused.
Learn Whether You May Join the Clover Health Data Breach Class Action
If you are or were a Clover Health member and received a data breach notice—or believe your personal or protected health information may have been exposed—please complete the confidential form on this page.
A data breach lawyer may contact you to discuss your rights and determine whether you may qualify to participate in the proposed class action or a related legal investigation. There is no cost or obligation to have your potential claim reviewed.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Submitting a form does not create an attorney-client relationship or guarantee eligibility, compensation, or any particular outcome.