Accounting Firm Blue & Co. reports data breach exposing client data
Learn More
Blue & Co., an accounting and advisory firm, is reporting data breach that compromised extensive personal and health information belonging to clients of the firm.
The breach was discovered on December 9, 2024, but the actual breach occurred approximately one month earlier, on or about November 7, 2024, and lasted for less than half an hour. The hacker was able to steal significant amounts of sensitive client information during the short breach window.
After detecting the incident, Blue & Co. isolated the affected server and engaging third-party forensic specialists to conduct an investigation. The analysis and review of the compromised data was completed on May 20, 2025. The exposed data includes:
- Names
- Social Security numbers
- Driver's license numbers
- Passport numbers
- Individual tax identification numbers
- Financial account information (with or without access credentials)
- Medical information
- Medical record numbers
- Diagnostic information
- Procedure types
- Admission dates
- Patient identification numbers
- Medicare identification numbers
- Billing and claims information
- Patient encounter numbers
- Treatment locations
- Treatment costs
- Prescription information
- Mental or physical condition details
- Treating or referring physician information
- Diagnostic codes
- Dates of birth
- Usernames and passwords
- Health insurance information
The nature of the attack and the number of affected individuals has not been disclosed.
Blue & Co. is sending direct notification letters to those whose data was involved, provided the company has a valid mailing address for them. The firm has established a dedicated assistance line at 866-819-2990, which became available starting July 7, 2025, and operates Monday through Friday from 9 a.m. to 6:30 p.m. Eastern time.
