Incident BriefingsBlossom Health EHR phishing incident

Blossom Health EHR phishing incident

Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026.

Last modified

Summary

  • Environment: Electronic health-record access
  • Operational impact: Patient information viewed after contractor phishing
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.

What happened

Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026. [1]

Impact

Viewed information could include patient names, contact details and health-insurance information. Blossom said Social Security numbers and payment-card information were not accessible. [1]

Timeline

  1. Unauthorized EHR access detected and removed

    Unauthorized EHR access detected and removed, according to the published account. Incident notice.

    [1]

  2. Notification letter dated

    Notification letter dated, according to the published account. Incident notice.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 4, 2026.

Threat Group & Attack Vector

The company traced entry to phishing of a non-employee contractor and removed the actor after detecting access. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Blossom removed access, changed passwords and added security measures. Its notice offered monitoring services. [1]