---
title: "Blossom Health EHR phishing incident"
description: "Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/blossom-health-ehr-phishing-incident-2026"
markdown_url: "https://www.ally.security/incidents/blossom-health-ehr-phishing-incident-2026.md"
stix_url: "https://www.ally.security/incidents/blossom-health-ehr-phishing-incident-2026/stix.json"
---

# Blossom Health EHR phishing incident

Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Electronic health-record access
- **Operational impact:** Patient information viewed after contractor phishing
- **Financial impact:** No incident cost disclosed

## What happened

[Blossom BH Opco Inc.](https://www.joinblossomhealth.com/) reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026. [1](#source-1)

## Impact

Viewed information could include patient names, contact details and health-insurance information. Blossom said Social Security numbers and payment-card information were not accessible. [1](#source-1)

## Timeline

### August 27, 2026 — Unauthorized EHR access detected and removed

Unauthorized EHR access detected and removed, according to the published account. [Incident notice](https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf). [1](#source-1)

### October 29, 2026 — Notification letter dated

Notification letter dated, according to the published account. [Incident notice](https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The company traced entry to phishing of a non-employee contractor and removed the actor after detecting access. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- T1566 — [Phishing](https://attack.mitre.org/techniques/T1566/). [1](#source-1)

## Response

Blossom removed access, changed passwords and added security measures. Its notice offered monitoring services. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/blossom-health-ehr-phishing-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Blossom BH Opco Inc. data security notice

official · Blossom BH Opco Inc. · Oct 29, 2026

<https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: Blossom removed access, changed passwords and added security measures. Its notice offered monitoring services.
2. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: The company traced entry to phishing of a non-employee contractor and removed the actor after detecting access.
3. **Discovered At · 100% confidence · current**  
   Blossom Health EHR phishing incident: 2026-08-27
4. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: Notification letter dated
5. **Used Attack Technique · 100% confidence · current**  
   Blossom Health EHR phishing incident: https://attack.mitre.org/techniques/T1566/
6. **Occurred At · 100% confidence · current**  
   Unauthorized EHR access detected and removed: 2026-08-27
7. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: Viewed information could include patient names, contact details and health-insurance information. Blossom said Social Security numbers and payment-card information were not accessible.
8. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: Unauthorized EHR access detected and removed
9. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-10-29
10. **Resulted In · 100% confidence · current**  
   Blossom Health EHR phishing incident: Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026.
11. **Affected Organization · 100% confidence · current**  
   Blossom Health EHR phishing incident: Blossom BH Opco Inc.

</details>