A security breach was reported involving Blossom Health, a telehealth and psychiatry platform. An extortionist, claiming to have accessed over 29,600 patient records, demanded a ransom of $30,000 in Bitcoin. The sensitive information included full names, phone numbers, emails, home addresses, and birthdates. The attacker used the patient messaging portal to deliver their ransom message directly to patients.
Named 'Stuckin2019,' the attacker admitted to an accidental mass message send to patients and revealed access was gained through an outdated staging environment. Blossom Health has not responded to inquiries about the incident, which could be a reportable breach under HIPAA.