Blossom Health Data Breach

A report filed with the Texas Attorney General says 27,623 people were affected in a data breach involving medical and health insurance information. For patients of a psychiatry practice, being on that list can be sensitive on its own.

Blossom BH Opco Inc., based in New York, filed the report with the Texas Attorney General. It was posted on October 30, 2026. The filing lists 2,014 Texans among the 27,623 people affected. Blossom BH Opco appears to operate Blossom Health, a telepsychiatry platform, although the filing does not say so.

According to the filing, the company discovered the incident on August 27, 2026, and notified people by U.S. Mail. Blossom Health offers online therapy and medication management for conditions such as anxiety, depression, ADHD, autism, bipolar disorder, and OCD.

Reports of Extortion Came Before the Public Filing

The Texas posting came 64 days after the company’s discovery date. Other reports surfaced in that gap.

DataBreaches.net reported on August 31, 2026 that a person identifying as a Blossom Health patient had contacted the outlet. The outlet reported that an extortionist appeared to have compromised the platform or an individual provider’s account.

On September 10, 2026, Cybersecurity News Everyday reported that a forum user offered records of more than 29,600 mental health patients for sale. That outlet called the claim unverified. The number also differs from the 27,623 in the Texas filing. Blossom Health has not confirmed the forum claim in any source we reviewed.

What Information Was Exposed?

The Texas filing lists:

• Name
• Medical information
• Health insurance information

The hacker’s claims listed more types of data, such as birth dates, contact details, provider names, appointment dates, and insurance member details. Those claims remain unconfirmed.

What Is Blossom Health Offering Affected Patients?

We have not confirmed whether Blossom Health is offering credit monitoring or identity protection. Patients who received a letter should check it for any offer, code, and deadline.

Why Mental Health Data Carries Extra Risk

A stolen password can be changed. A mental health history cannot. When a breach involves a psychiatry platform, simply being listed as a patient can reveal private information.

Criminals may use that sensitivity to pressure people. They may threaten to expose treatment details unless a victim pays. Insurance details can also be misused for false claims.

Affected individuals can take these steps:

• Save the notice letter and any suspicious messages
• Do not pay or reply to anyone who threatens to release records
• Review statements from health plans and providers
• Report threats to local law enforcement and the FBI at www.ic3.gov

Do You Have Legal Options?

Healthcare providers that collect mental health information have a duty to protect it. When that duty is not met, affected patients may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

FAQ

How many people were affected?

The Texas Attorney General filing lists 27,623 people in total, including 2,014 Texans.

What information was exposed?

The filing lists name, medical information, and health insurance information.

Is Blossom BH Opco the same as Blossom Health?

It appears so, but the Texas filing does not say so directly. Check the name on your letter.

I received a threatening message. What should I do?

Do not pay and do not reply. Save the message. Report it to law enforcement and at www.ic3.gov.

Why does a medical data breach matter?

Medical data can reveal private health details, and it cannot be replaced like a card number. It can also be used for insurance fraud or medical identity theft.

What should I do with my notice letter?

Keep it. The letter may include an enrollment code, deadlines, and details about your information. Save the envelope too.

Do I have a legal claim?

You may. Blossom Health had a duty to protect your medical and mental health information. When that duty is not met, affected individuals may have legal rights and remedies. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.