Blue & Co. Data Breach Investigation

Recently, Blue & Co. announced that it had experienced a data breach in which the sensitive personal identifiable information and protected health information in its care may have been compromised. According to the breach notice, on December 9, 2024, Blue & Co. learned of an unauthorized actor who claimed to have taken data from a server in Blue & Co.’s IT environment.¹ As a result, Blue & Co. launched an investigation to determine the nature of the incident.

Through its investigation, Blue & Co. confirmed that sensitive personal identifiable information and protected health information in its systems may have been accessed by an unauthorized third party on or around November 7, 2024.¹ While the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Social Security number
• Date of birth
• Driver’s license number
• Passport number
• Individual tax identification number
• Financial account information with or without access credential
• Medical information (medical record number, diagnostic information, procedure type, admission date, patient identification number, Medicare identification number, billing / claims information, patient encounter number, treatment location, treatment cost, prescription information, mental or physical condition, treating/referring physician, diagnostic code)
• Health insurance information
• Username/password

As a result of the data breach, Blue & Co. posted a notice of the incident on its website. Additionally, on July 3, 2025, Blue & Co. began sending breach notification letters to impacted individuals.¹ A link to the website breach notice is below.