Zero Radar
← feed
MediumData breachupdated 27 Oct 2026, 18:56 UTC

Covered California agent data exposed through phishing attack

An attacker tricked someone into giving up access, and spreadsheets containing agents' personal information were viewed. Agents whose details were in those files may be at risk of scams.

1 source, unconfirmed
SeverityMediumData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureBe suspicious of unsolicited requests for information and check the official breach notice to see what data was exposed.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Phishing messageDeceptive message sent to a user
  2. 2Credentials givenAccess obtained through the phishing attempt
  3. 3Spreadsheets accessedAgent information files viewed without authorization
  4. 4Breach notice sentAffected agents notified after the fact
  5. ResultAgent personal information disclosed to attacker

What happened

A phishing attack gave an unauthorized party access to Covered California agent information spreadsheets on May 13, according to a sample breach notice posted to the California attorney general's website on Oct. 16.

Why it is dangerous: Agents whose information was in the exposed spreadsheets could be targeted by follow-on phishing or identity misuse; the notice confirms their information was disclosed.

Are you affected?

You are affected if you are an agent whose information was included in the Covered California agent spreadsheets accessed in the May 13 incident.

Covered California agent information spreadsheets (agents' personal information).

What to do

  1. Watch for unexpected emails, calls, or messages asking for logins, personal details, or payments, especially ones referencing Covered California.
  2. Review the breach notice letter from Covered California for the specific data involved and any offered protections.
  3. Use unique passwords and enable multi-factor authentication on accounts tied to your agent work.

Timeline

  1. 27 Oct 2026, 18:41 UTC
    Publicly disclosed
  2. 27 Oct 2026, 18:41 UTC
    Reported by DataBreaches.net · DataBreaches.net
  3. 27 Oct 2026, 18:56 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-8636f225
Disclosed
27 Oct 2026, 18:41 UTC
On Zero Radar
27 Oct 2026, 18:56 UTC (14 min after disclosure)
Last change
27 Oct 2026, 18:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Covered California agent data exposed through phishing attack · Zero Radar