.png)
Blue & Co. Data Breach Investigation
Shamis & Gentile P.A., one of the nation's premier class action law firms specializing in data breach cases, is investigating the Blue & Co. LLC data breach.
If you were affected by the data breach, your sensitive personally identifiable information may have been exposed, and you may be eligible for compensation.
About Blue & Co. LLC
Blue & Co. LLC is an accounting and advisory firm that has been operating since 1970. With more than 560 employees and over a dozen offices across Indiana, Ohio, Kentucky, Michigan and Texas, the company provides services such as assurance, tax compliance, consulting, benefit plan services and business valuations.
Blue & Co. is recognized as one of the largest CPA firms in the United States, often ranking within the top 50 to 55 firms nationally.
What Happened?
On Dec. 9, 2024, Blue & Co. discovered that an unauthorized actor claimed to have taken data from one of its servers. The investigation revealed that the breach occurred on or about Nov. 7, 2024, and lasted less than half an hour. During this brief window, sensitive data was removed from Blue & Co.'s IT environment.
The company immediately isolated the impacted server and worked with third-party forensic specialists to assess the situation. By May 20, 2025, Blue & Co. completed a detailed review to determine what information was affected and who was impacted. Notifications to affected individuals began on July 8, 2025.
Information Exposed:
- Name
- Social Security number
- Driver’s license number
- Passport number
- Individual tax identification number
- Financial account information (with or without access credentials)
- Medical information
- Medical record number
- Diagnostic information
- Procedure type
- Admission date
- Patient identification number
- Medicare identification number
- Billing and claims information
- Patient encounter number
- Treatment location
- Treatment cost
- Prescription information
- Mental or physical condition
- Treating or referring physician
- Diagnostic code
- Date of birth
- Username and password
- Health insurance information
Blue & Co. reported the incident to law enforcement and the U.S. Department of Health and Human Services. The company is offering identity monitoring services through Kroll to those affected.
Your Rights and Next Steps
If you received a notice from Blue & Co. or believe you may have been impacted, there are important steps you can take to protect yourself and your rights.
First, Blue & Co. is offering complimentary identity monitoring services through Kroll. This includes single bureau credit monitoring, fraud consultation and identity theft restoration. Affected individuals should activate these services as soon as possible using the instructions provided in their notification letter.
It is also wise to remain vigilant by regularly reviewing account statements, explanation of benefits and credit reports for any suspicious activity. Under federal law, everyone is entitled to one free credit report per year from each of the three major credit bureaus. Consider placing a fraud alert or a credit freeze on your credit file for extra protection.
If you notice any unauthorized activity, report it immediately to your financial institutions and the credit bureaus. You also have the right to file a police report if you are a victim of identity theft.
Lawyers are ready to help individuals who have been affected by this data breach. If your information was exposed, you may be eligible to join a class action lawsuit seeking compensation for any harm or risk resulting from the breach.
You May Be Entitled to Compensation
If you were impacted by the Blue & Co. data breach, you may have legal rights and could be entitled to financial compensation. Lawyers are actively investigating this incident and are prepared to help you understand your options and pursue a claim.
To find out if you qualify and to take the next step, complete the below form to join the lawsuit investigation.
.svg)