Blossom BH Opco, a New York company that operates an online psychiatry service, has reported a data breach involving medical and health insurance information. This page summarizes what is publicly known from the Texas Attorney General’s breach report.
Blossom BH Opco’s Data Breach Investigation
On October 30, 2026, the Texas Attorney General’s Office published a data security breach report filed by Blossom BH Opco Inc., which lists a New York, New York address. The report states that 2,014 Texans were affected and that the company notified them by U.S. Mail. Blossom BH Opco’s own website terms identify it as the provider of an online psychiatry service that accepts health insurance.
The report lists three categories of information: names, medical information and health insurance information. It does not say what kinds of medical details are involved, such as diagnoses, medications, treatment notes or appointment history, and it does not say whether the information belongs to patients, to people who only created an account or to employees. The public listing is the only record found so far, and no company statement or news coverage about the incident has been located.
The figure of 2,014 applies only to Texas residents. Companies that offer services across the country usually notify people in each state separately and report to each state’s regulator, so the Texas count should not be treated as the total number of people affected. The total across all states has not been published.
The cause has not been disclosed. Nothing in the Texas report indicates whether an outside attacker, a vendor that handles records for the company or an internal mistake was responsible, and it does not say whether credit monitoring or identity protection is being offered. Anyone who received a letter should rely on it for those details, including any enrollment deadline.
Information that connects a person’s name to mental health care or to a health plan is among the most sensitive data that can be exposed. Unlike a card number, medical details cannot be canceled and replaced. Health insurance information can also be used for medical identity theft, such as billing for services that were never provided or filing false claims, and details about a person’s care can be used to make scam messages look believable. Beyond financial risk, many people also worry about the privacy of the fact that they sought care at all.
Companies that provide health services are required to protect patient information under federal privacy and security rules and under state law, and they must notify affected people without unreasonable delay after a breach. Telehealth providers are covered by the same standards as in-person practices when they handle protected health information. Attorneys are looking into whether reasonable steps were taken to safeguard the information involved and whether the notice met the standards that apply.
People who receive a letter involving health information are often advised to review explanation of benefits statements and insurer portals for services they do not recognize, to ask their insurer to flag the account for suspicious activity, and to consider a credit freeze. Keep the notice, write down the date it arrived and any reference number or enrollment code it contains, and treat unexpected calls or messages that mention the incident with caution.
Online and telehealth care has grown quickly, and providers in that field typically collect sign-up details, insurance information and clinical notes through web portals and connected software. That means a single security lapse at the company, or at a vendor that supports it, can affect people in many states at once. It also means patients may not realize which company holds their records, since they often interact only with a clinician and a booking site. Anyone who has used an online psychiatry service and received a letter from a company they do not recognize should check whether it is the operator of that service.
The Texas listing is a summary meant to tell the public that a notice was submitted. It records the company’s name and address, the categories of information, the number of Texans, the way they were notified and the publication date. Details such as the cause, the dates, the nationwide total and the company’s response usually appear only in the letters sent to individuals or in later regulatory filings, which is why this page can report only what the listing confirms.
When Did This Breach Occur?
The Texas report gives the date it was published, October 30, 2026, but does not state when the incident happened or when it was discovered. No timeline showing when unauthorized access began, was detected or ended has been published, so the timing of the underlying event should be treated as unknown for now.
What Information Was Breached?
The Texas report lists names, medical information and health insurance information. It does not describe the specific medical details involved. Not every person will have had every category exposed, so your notice letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Blossom BH Opco or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Review explanation of benefits statements and insurer account activity for services you did not receive, and consider asking your health insurer to flag your account for suspicious activity.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Blossom BH Opco
If you received a notice from Blossom BH Opco, or you believe your medical or health insurance information was involved, you may have legal options for holding the company accountable for how it protected your sensitive data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
