Short answer
Blossom Health, an online telepsychiatry provider, says an unauthorized person accessed its electronic health record software on 27 August 2026 and downloaded a limited number of patient records and a user spreadsheet. Mental health records make follow-on scams especially harmful.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Blossom Health (Blossom BH Opco, Inc.) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (telepsychiatry) |
| Country | United States |
| Detected | 2026-08-27 |
| Disclosed | 2026-10-29 |
| People or records affected | Total not disclosed. HIPAA Journal reports 2,103 Texas residents, and Texas filings are described elsewhere with a slightly different count. |
What data was exposed
- A limited number of patient medical records (per Blossom's notice)
- A user spreadsheet containing patient information (per Blossom's notice)
- Names, contact information and health insurance information (per HIPAA Journal, citing a Texas filing)
What happened
Blossom Health, legally Blossom BH Opco, Inc., provides online psychiatry and mental health care. In its regulatory disclosure notice, Blossom says it became aware of suspicious activity in its electronic health records (EHR) software on 27 August 2026. Its investigation found that an unauthorized individual accessed the EHR and downloaded a limited number of patient medical records and a user spreadsheet containing patient information. Blossom says it has no evidence the information has been misused.
It activated incident response, changed user passwords, added security measures and mailed letters to people with known addresses, offering credit monitoring and identity protection.
What reporting adds
HIPAA Journal reported on 4 November that letters were dated 29 October and that a Texas attorney general filing listed 2,103 Texas residents. It lists names, contact details and health insurance information, and says Blossom stated financial information and Social Security numbers were not accessible. The outlet attributes the entry point to phishing of a non-employee contractor. Blossom’s notice does not describe the method, so treat that as the outlet’s report.
Claims we could not verify
Secondary reports say a seller using the name “2019” offered records on about 29,600 Blossom patients. Blossom has not confirmed that number and we could not confirm it from a primary source. One tracker lists a different Texas count and different dates for the seller’s post, so we do not rely on those details.
What is still unknown
- the total number of people affected;
- exactly which fields were in the records and spreadsheet;
- whether any data has been published.
Staying safe
Mental health information is sensitive, and extortion messages that name a diagnosis are a known pattern after health breaches. Never pay such a demand. Our guide to phishing messages shows how to check a sender, and what to do after a data breach covers freezes and monitoring. For callers pressing you to act fast, see government impersonation scams.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Messages that threaten to reveal your mental health treatment unless you pay (extortion)
- Fake 'Blossom Health' emails about account problems or credit monitoring that link to lookalike pages
- Calls from a supposed insurer or clinic using your provider or plan details
- Phishing texts offering to 'remove' your data for a fee
What to do if you are affected
- 01Look for a letter from Blossom Health and use the contacts in it. The notice lists an incident line at 1-855-711-7845.
- 02Do not pay anyone who threatens to publish or sell your health information. Keep the message and report it to the FBI's IC3 and local police.
- 03Review bank accounts and explanations of benefits for anything you do not recognise, as Blossom advises.
- 04Enrol in any credit monitoring offered in your letter, using the instructions in that letter.
- 05Consider a credit freeze, and check the FTC guidance at consumer.ftc.gov for identity theft steps.
Frequently asked questions
What did Blossom Health confirm?
That an unauthorized person accessed its EHR software and downloaded a limited number of patient medical records and a user spreadsheet, and that it found no evidence of misuse.
How many people are affected?
Blossom has not given a total. HIPAA Journal reports 2,103 Texas residents from a Texas attorney general notice. Another tracker lists 2,014, so the Texas figure is not consistent across sources.
Was the data put up for sale?
Secondary reports say a seller using the name '2019' claimed a larger database of about 29,600 patients. Blossom has not confirmed that figure, and we could not verify it.
Was the breach caused by phishing?
HIPAA Journal reports that it began with phishing of a non-employee contractor. Blossom's own notice does not state the method.
What is Blossom doing?
Its notice says it changed user passwords, added technical and security measures, and mailed letters offering credit monitoring and identity protection.
Sources
- Regulatory Disclosure Notice, Blossom Health, 2026-11-06
- Data Breaches Announced by HCA Healthcare, Blossom Health, El Camino Health and UMMC, HIPAA Journal, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.