Clover Health Hit by Social Engineering Attack

What Happened

Clover Health Investments, a healthcare technology and Medicare Advantage insurance plan provider, has publicly disclosed a cybersecurity breach affecting customer data. According to the company's official filing with the U.S. Securities and Exchange Commission (SEC), the incident was discovered on July 4. Initial investigations revealed that attackers infiltrated the company's systems using social engineering methods. This attack resulted in the compromise of three non-managerial employee accounts.

Immediately upon detection, Clover Health stated it activated its cybersecurity incident response plan. The company engaged independent, third-party cybersecurity experts to manage the process and fully understand the extent of the attack. While the company reports that the attackers have been evicted from its systems and the breach has been contained, it emphasized that the investigation into the precise nature and scope of the stolen data is still ongoing. Such breaches pose significant legal and reputational risks, especially for companies operating in sectors that handle sensitive data like healthcare.

Data Compromised

According to Clover Health's statement, the data accessed by the attackers includes customers' Personally Identifiable Information (PII) and Protected Health Information (PHI). However, a specific list of what types of PII and PHI were leaked has not yet been shared. The company made a point to state that the compromised accounts did not have access to corporate financial or claims systems. While this may mitigate the risk of direct financial fraud, the potential for misuse of the leaked health data remains a serious concern.

Personally Identifiable Information (PII) encompasses any information that can be used to identify an individual, either directly or indirectly. This category typically includes data such as name, address, phone number, and Social Security number. Clover Health has not yet clarified which of these data points were affected.

Protected Health Information (PHI) is a much more sensitive data type. Strictly protected in the U.S. under the Health Insurance Portability and Accountability Act (HIPAA), this information includes diagnoses, treatment histories, insurance information, physician's notes, and lab results. The leakage of such data can be exploited for severe crimes, including identity theft, insurance fraud, and even blackmail.

How the Attack Occurred

The attack was based on a method called social engineering. This tactic targets human psychology and weaknesses rather than technical vulnerabilities. Attackers manipulate, deceive, or impersonate individuals to trick employees into revealing confidential information, such as usernames and passwords. In the Clover Health case, the attackers successfully used this method to compromise the accounts of three employees.

The company specified that the compromised accounts belonged to employees with "member visit-scheduling and broker-facing sales functions." This implies that through these accounts, the attackers could have accessed patient appointment information, contact details, and other sensitive data related to insurance policies. Social engineering attacks often take the following forms:

• Phishing: The most common method, where attackers send fake emails that appear to come from a legitimate source (e.g., the HR department, IT support, or a business partner) to steal employees' passwords or other sensitive information.
• Vishing (Voice Phishing): Attackers call employees, impersonate an authoritative figure, and try to extract information by creating a sense of urgency.
• Pretexting: A tactic where the attacker creates a fabricated scenario (a pretext) to gain access to information.

Clover Health has not shared technical details about which of these specific methods were used in the attack. However, it is clear that the incident stemmed from a security vulnerability related to the human element.

Who Is Affected

Founded in 2014, Clover Health Investments is a company that provides Medicare Advantage insurance plans, operating as a direct contractor with the U.S. government. Therefore, those affected by this data breach are primarily customers who hold a Medicare Advantage insurance policy with Clover Health. As the investigation is ongoing, the total number of affected customers has not yet been shared with the public. The company is expected to provide direct notification to all affected individuals as required by law once the investigation concludes.

What You Can Do

If you are a current or former customer of Clover Health, it is important to take proactive steps to protect yourself against the possibility that your data was compromised. You can take the following measures without waiting for an official notification from the company:

• Monitor Your Accounts: Carefully review your "Explanation of Benefits" (EOB) documents from your health insurer. Check for any billing for medical services or treatments you did not receive.
• Be Wary of Phishing Attacks: Cybercriminals can use your stolen personal and health information to send you highly convincing, targeted phishing emails. Be suspicious of emails and text messages claiming to be from Clover Health or other healthcare providers that ask for personal information or passwords.
• Check Your Credit Reports: Fraudsters may attempt to use your personal information to apply for credit cards or loans in your name. Regularly check your credit reports to detect any suspicious activity.
• Wait for Official Communication: For information about the breach, rely only on Clover Health's official website and official communication channels. Do not trust third parties who contact you by phone or email offering help.

What the Company Says

In its filing with the SEC, Clover Health Investments stated that it is approaching the incident with transparency. According to the company's statement, its incident response plan was activated immediately after the breach was discovered on July 4. A third-party firm of cybersecurity experts was engaged to contain the attack and cleanse the systems. The company expressed its belief that the attackers have been removed from its systems and the threat has been neutralized.

However, it was also reported that the investigation is still in its early stages, and efforts to determine the full scope, nature, and volume of the leaked data are ongoing. To date, no known ransomware or cybercriminal group has claimed responsibility for the attack. The company has committed to informing the public and affected customers as the investigation progresses and more information becomes clear.

Source

https://www.securityweek.com/clover-health-investments-discloses-data-breach/