iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The headline’s “250,000” refers to two separate healthcare data breaches—not one combined attack. The U.S. Department of Health and Human Services (HHS) lists 138,677 people for Clover Health and 126,196 for AngMar Management Services, a combined 264,873. The incidents involved different organizations, access paths and notices.
How many people were affected?
HHS’s breach portal lists 138,677 people for Clover Health and 126,196 for AngMar Management Services. The entries show submission dates of September 14 and September 16, 2026, respectively. Adding those two separate figures gives 264,873; HHS does not publish that sum as a combined incident total.
HHS classifies both entries as hacking/IT incidents. It identifies Clover as a health plan and AngMar as a Texas business associate. The portal gives Minnesota as Clover’s filing state, while SecurityWeek describes the company as based in Jersey City, New Jersey; these are different geographic details, not a contradiction about a single location.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What happened at each organization?
Clover Health: social engineering and employee accounts
Clover’s Form 8-K filing says it became aware of anomalous login activity on July 4, 2026. Its investigation found that an attacker used social engineering to access three non-managerial health-plan employee accounts. The accounts could access certain personal and protected health information, but not the company’s corporate financial or claims systems. Clover said the precise scope was still under investigation when it filed.
#1 Best Overall
The filing says Clover activated incident-response procedures, worked with outside cybersecurity experts, took steps to contain the activity, notified law enforcement and was assessing notification requirements. It describes the data involved as personally identifiable information (PII) and protected health information (PHI). SecurityWeek reports that potentially affected information included names, dates of birth, insurance identifiers and account identification numbers; the filing itself does not confirm a final list of exposed data.
AngMar Management Services: unusual network activity
AngMar’s data-event notice says the company identified unusual network activity on July 20 and that information may have been accessed or acquired around July 18, 2026. HHS classifies the incident as involving a network server.
SecurityWeek reported that the Interlock ransomware group added AngMar to its leak site and claimed to have stolen more than 700 gigabytes of data. That volume is the group’s claim as reported by SecurityWeek, not an independently verified finding in the cited official notice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What information may have been involved?
Clover Health
Clover’s filing confirms access to accounts with access to certain PII and PHI, but says the investigation had not yet established the exact scope. SecurityWeek’s reported categories—names, dates of birth, insurance identifiers and account identification numbers—should therefore be understood as potentially affected information, not a final account of every person’s data.
AngMar Management Services
AngMar says the information potentially involved could include a person’s name together with one or more of the following: address, date of birth, Social Security number, patient ID, medical record number, health insurance information, service date, diagnosis or condition information, provider name, prescription information, or medical history. Categories varied; the notice does not say that every category applied to every person.
Was my information affected?
The public breach entries and AngMar’s notice do not let a reader determine an individual’s status. Check for a direct notice from Clover or AngMar and follow the instructions in that notice. If you have not received one but are concerned, contact the organization using contact details from its official website rather than relying on an unsolicited message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if I received a notice?
If your notice is from AngMar
AngMar’s September 22, 2026 notice says: “At this time, there is no evidence to suggest that any of your information has been, or will be, misused.” That is the company’s statement as of the notice, not a guarantee about future misuse. The notice describes complimentary single-bureau credit monitoring through Cyberscout, a TransUnion company, and recommends staying vigilant and reviewing credit reports and account statements. Use the notice’s eligibility and enrollment instructions; its published version redacts the service duration.
- Review the notice to confirm which information categories may apply to you and whether you are eligible for the monitoring offer.
- Check your credit reports and account statements for activity you do not recognize.
- Be cautious about unexpected messages that ask for personal, insurance or payment information.
If your notice is from Clover
Clover’s July 2026 filing describes its response and says it was assessing notification requirements. The cited filing and HHS entry do not establish whether Clover later offered monitoring or other services to members. Follow the terms in any direct notice you receive for the latest information about your eligibility and available steps.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
