Almeida Law Group is investigating a data breach at Blossom BH Opco Inc. The breach was discovered on August 27th, 2026. If you were affected, contact Almeida Law Group.
About Blossom BH Opco Inc.
Blossom BH Opco Inc. does business as Blossom Health, an internet-based telepsychiatry company founded in 2024 by CEO John Zhao and based at 169 Madison Ave, New York, New York 10016. The company provides virtual psychiatry and therapy services, including medication management for conditions such as anxiety, depression, and ADHD, through a telehealth platform staffed by affiliated psychiatrists and psychiatric nurse practitioners. Because Blossom Health delivers mental health care and handles patient administration and billing, it collects sensitive medical and health insurance information as part of its operations.
What Happened?
Blossom BH Opco Inc. was listed in a Texas Attorney General data security breach report filed on October 30th, 2026. The filing identifies the incident as affecting 27,623 individuals in total, with names, medical information, and health insurance information involved. The breach was discovered on August 27th, 2026, and the company notified affected consumers by U.S. Mail.
Independent reporting by DataBreaches.net sheds additional light on what likely triggered the breach. On August 27th, 2026, a threat actor known as “Stuckin2019” sent a three-part extortion message directly through Blossom Health’s authenticated patient messaging portal, using a clinician profile that DataBreaches.net assessed was most likely not a genuine account. The attacker claimed to have gained access through an old staging environment and demanded $30,000 in Bitcoin, alleging access to over 29,600 patient records. DataBreaches.net described the incident as pure data extortion with no ransomware encryption or operational disruption reported. Importantly, these are attacker allegations, not facts confirmed by Blossom Health. As of August 31st, 2026, the company had not responded to DataBreaches.net’s inquiries and had not posted any public notice on its website. The Texas Attorney General filing, published October 30th, 2026, represents the first official confirmation from a regulator. The threat actor “Stuckin2019” had previously been linked by DataBreaches.net to attacks on two other telehealth platforms, OpenLoop and Zealthy, in March 2026. No confirmed class action lawsuit has been filed, though Shamis & Gentile P.A. has publicly announced it is investigating the Blossom Health breach for a potential class action on behalf of affected individuals.
Key Facts at a Glance
- Company or Organization: Blossom BH Opco Inc. (d/b/a Blossom Health)
- Industry: Healthcare – Telehealth / Mental Health / Telepsychiatry
- Location: New York, New York 10016
- Incident type: Data extortion / unauthorized access
- Date breach discovered: August 27th, 2026
- Date of consumer notification: October 30th, 2026
- Total persons affected: 27,623
- Prior breach: No prior breaches confirmed for Blossom Health; threat actor “Stuckin2019” was previously linked to attacks on telehealth platforms OpenLoop and Zealthy in March 2026
- Litigation status: No class action filed; Shamis & Gentile P.A. has announced an investigation into a potential class action as of October 30th, 2026
- Source: Texas Attorney General Data Security Breach Report – BR-0005473; DataBreaches.net; ClaimDepot – Shamis & Gentile Investigation
What Should You Do?
If you received a notice from Blossom Health, you should act promptly to protect yourself. Because names, medical information, and health insurance information were involved, review your Explanation of Benefits statements and medical records for any services you did not receive or authorize, and report discrepancies to your insurer. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unfamiliar accounts or inquiries. You can request free annual credit reports at AnnualCreditReport.com. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step recovery guidance. Keep records of any suspicious activity and any communications you receive related to this breach.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
