> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Blossom Health Records on 29,600 Mental Health Patients Offered for Sale
- URL: https://darkwebinformer.com/blossom-health-records-on-29-600-mental-health-patients-offered-for-sale/
- Published: 2026-09-09T16:35:57.000Z
- Updated: 2026-09-09T16:35:57.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report United States Mental Health Data Price By Offer 

## Blossom Health Records on 29,600 Mental Health Patients Offered for Sale

A forum actor posting as **2019** is selling what they describe as the patient database of **Blossom Health**, a virtual psychiatric care platform in the United States that provides online therapy and medication management for conditions including anxiety, depression, ADHD, autism, bipolar disorder and OCD. The listing covers **more than 29,600 patients** and the stated fields include **legal, preferred and middle names, date of birth, gender, phone number, email, full home address, the assigned provider and referring physician, first and last appointment dates, account status and tags**, together with a complete billing layer: **insurance payer, member, plan and group identifiers, copay amounts and policy subscriber details**. It is offered as a **one time sale** in cryptocurrency. The claim is **unverified**.

Severity CRITICAL 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Patients29,600+

Insurance dataIncluded

SaleOne time

Actor2019

### ▣Post details

TargetBlossom Health

CountryUnited States

SectorVirtual psychiatric care

ListingOne time sale, crypto

Volume29,600+ patients

Stated sourceNot described

ObservedSep 9, 2026

Actor2019

### !What the post claims

- More than 29,600 patients
- Legal and preferred names
- Middle and last names
- Dates of birth
- Gender
- Phone numbers and emails
- Full home addresses
- Assigned provider named
- Referring physician
- First appointment dates
- Last appointment dates
- Client since dates
- Current status and tags
- Billing type
- Insurance payer identifiers
- Insurance member identifiers
- Plan and group identifiers
- Copay amounts
- Policy subscriber details
- Subscriber address and birth date

### ◱Screenshot

[ ![Forum listing selling patient records attributed to a US virtual psychiatric care platform, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/123789562793856987263596872369578987123.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/123789562793856987263596872369578987123.png) 

Forum post offering Blossom Health patient records for sale, observed 9 September 2026.

### ☷Mapped techniques

The post describes no intrusion method. Both entries are inferred from the artefacts, not stated.

- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Inferred Clinical scheduling fields and the insurance billing layer appear in one uniform row set, which points to an export from the practice management system rather than data assembled from several places.
- Exfiltration [T1567](https://attack.mitre.org/techniques/T1567/) Exfiltration over web service Inferred The sample is published inline and the sale is arranged through messaging services. The route out of the environment is not described.

### ⚠Potential impact

With a psychiatric provider, **being in the file is itself the sensitive fact**. Membership discloses that a named person at a known address is in mental health treatment, which reaches employment, custody proceedings, insurance and immigration matters, and the provider, tag and appointment fields narrow the picture considerably further. The billing layer creates a second and separate harm: **insurance member, plan and group identifiers support medical identity theft and fraudulent claims**, a form of fraud victims usually discover only when a bill or a denial arrives. The population also deserves care in how this is reported, since some of these people are **currently unwell**, and extortion or exposure threats aimed at psychiatric patients carry obvious risk.

### iStatus Unverified

The sample is **long and internally consistent**, with real insurer names, member identifier formats that match those carriers' conventions, and addresses whose city, state and postal code agree, which is difficult to fabricate across many rows. What is missing is **any account of how the data was obtained**, with no method, no date and no indication whether access has been closed. The account is **established with high standing**, and the one time sale framing limits circulation while implying a single buyer with a specific use. Dark Web Informer has **not retrieved the data and is not linking the contact addresses**, and Blossom Health has not publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=blossom-health-2026-09-09&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=blossom-health-2026-09-09&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=blossom-health-2026-09-09&utm%5Fcontent=footer) // Threat Intelligence