Clover Health Investments didn’t get hit by a zero-day. Nobody found a hole in their code. According to the company’s own breach disclosure, someone picked up a phone, talked their way past an employee, and walked out with access to systems holding personal and health information for members of a Medicare Advantage insurer. No exploit chain, no malware sample for researchers to dissect. Just a conversation that went the attacker’s way.

That’s the part of cybersecurity that keeps getting underfunded. Security teams pour budget into patch management, endpoint detection, and network segmentation, and all of it matters. But attackers have learned that the fastest path into a company with real data still runs through a person answering a support line, not a server answering a port scan.

The Weak Link Cybersecurity Budgets Keep Skipping

Clover Health hasn’t published a blow-by-blow of the intrusion, but “social engineering” compromising “employee accounts” points toward a familiar pattern: an attacker impersonates someone with legitimate reason to request a password reset, an MFA re-enrollment, or a login assist, and a help desk or an individual employee grants it. This is the same playbook that’s taken down casinos, airlines, and telecoms over the past two years, and it works because it targets a layer most security programs still treat as a training slide instead of a control surface.

Here’s the uncomfortable math. A company can spend seven figures on threat detection and still lose the game in a five-minute phone call, because the attacker isn’t fighting your firewall or your intrusion detection stack. They’re fighting whichever employee happens to answer, on whichever day that employee is tired, rushed, or just trying to be helpful. Health insurers are a particularly attractive target for this because the data behind those employee accounts, diagnoses, treatment history, Social Security numbers, is worth far more on resale than a stolen credit card number, and because insurers run large, distributed workforces where a caller claiming to be “the new guy in claims processing” can sound entirely plausible.

Once They’re In, Your Other Systems Become the Story

The account takeover is rarely the whole incident. It’s the entry point. What an attacker does after they’re inside an employee’s session is where the real damage compounds, and this week gave two good reminders of why that matters. SecurityWeek reported exploitation of a ServiceNow AI platform flaw, CVE-2026-6875, showing up in the wild just days after disclosure, capable of remote code execution against a platform plenty of enterprises use to manage exactly the kind of internal ticketing and access workflows that a compromised employee account would touch. Separately, Zimbra shipped patches for command injection, SSRF, and access-restriction bypass bugs in its mail platform, the kind of software that sits at the center of internal communication and is a favorite pivot point once an attacker has a foothold.

None of these stories are the same incident. But they describe the same threat model: get past the human layer, then move laterally through whatever internal platform trusts that now-compromised identity a little too much. Threat detection tools built to watch for malware signatures or unusual outbound traffic often miss this entirely, because from the system’s perspective, it’s just a real employee logging into real systems they’re authorized to use. That’s why defense in depth still matters even after the perimeter has failed once. A breach at the account level shouldn’t automatically become a breach of everything that account can touch.

What Actually Slows These Attacks Down

Security hardening against social engineering isn’t about better posters in the break room. It’s about removing the human’s ability to be the single point of failure. A few things genuinely move the needle.

Phishing-resistant MFA, the kind based on hardware keys or platform authenticators rather than SMS codes or push notifications, closes off the easiest version of this attack, where a caller convinces someone to approve an MFA prompt they didn’t request. Help desks need a verification protocol for identity resets that doesn’t rely on information an attacker can gather from LinkedIn or a previous breach, think callback to a known number, or verification through a manager, not “what’s your date of birth.” Conditional access policies that flag logins from new devices or unusual locations, even when the credentials and MFA check out, give your incident response team a chance to catch the takeover before the attacker gets comfortable.

On the infrastructure side, rate limiting and brute-force protection on authentication endpoints still earn their keep, because plenty of these campaigns pair social engineering with credential stuffing to find which accounts are worth calling about in the first place. Session monitoring that flags an account suddenly accessing systems or data volumes it’s never touched before is worth more than another layer of network firewall rules, because by the time this kind of attacker is inside, the firewall has already done its job and stepped aside. And once an account takeover is confirmed, incident response needs to assume lateral movement until proven otherwise: rotate credentials, review every system that account could reach, and check whether tickets, tokens, or API keys tied to that identity were touched.

Clover Health’s disclosure is a reminder that cyber security programs built entirely around technical exploits are only defending half the building. The other half has a phone number.

Frequently Asked Questions

What makes social engineering harder to defend against than a software exploit?

A software vulnerability has a patch. A social engineering attack targets human judgment under pressure, which varies by person and by day, so there’s no single fix, only layered controls like verification protocols and phishing-resistant MFA that reduce how often the attack succeeds.

Why are healthcare and insurance companies frequent targets?

Health records combine identity data, financial data, and treatment history in one package, which sells for more on criminal markets than financial data alone, and these organizations often run large workforces that make impersonation easier.

Does MFA prevent this kind of breach?

Not by itself. Push-based and SMS-based MFA can be talked around through prompt fatigue or SIM-swap style tricks. Phishing-resistant methods like hardware security keys close that gap significantly.

Sources

• Clover Health Investments Discloses Data Breach
• Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
• Zimbra Update Patches Critical Vulnerabilities