Blossom Health Data Breach Exposed Sensitive PHI and PII

Blossom Health, an AI-powered telepsychiatry company operating under the legal name Blossom BH Opco Inc., disclosed a data breach involving unauthorized access to patient information.

On Aug. 27, 2026, unauthorized access to a software tool used in Blossom Health's business operations was discovered. Upon detecting the suspicious activity, the company implemented its incident response protocols and launched an investigation. The investigation found that the unauthorized access to the DRF software platform may have resulted in the exposure of certain patient records.

On Sept. 9, 2026, a threat actor using the name "2019" posted a claim on the open web alleging they had breached Blossom Health's database. The compromised data reportedly included unique IDs, client names, preferred names, legal names, dates of birth, gender, phone numbers, email addresses, physical addresses, appointment information, insurance details, provider information, subscription details, archived dates and record identifiers.

The types of information confirmed to have been exposed in this breach included both personally identifiable information (PII) and protected health information (PHI) such as names, dates of birth, Social Security numbers, medical information, treatment details, health insurance information and patient medical records.

The breach was disclosed to the Texas Attorney General, with 2,014 Texas residents identified as affected. The company also posted a regulatory disclosure notice on its website. Blossom Health notified affected consumers by U.S. Mail.

Blossom Health's response to the breach

Blossom Health set up a dedicated call center for individuals with questions about the breach. Affected individuals can reach the call center by calling 877-742-7247, Monday through Friday, from 8 a.m. to 8 p.m. EST.