NOTICE OF SECURITY INCIDENT
Key Details & Response
Although we have strict security measures in place to protect information in our care, Blue & Co., LLC, recently learned of a data security incident that may have affected the privacy of personal information related to certain individuals.
The following information provides details about the event, our response, and steps impacted individuals can take to better protect against the possible misuse of their information should they feel it is appropriate to do so.
-2.png "padlock with checkmark inside and arrows")
WHAT HAPPENED
Timeline of Events
Blue & Co., LLC (“Blue”) is a financial consultant for companies and is providing notice of an incident that may have affected the privacy of personal information related to certain individuals and patients.
Individuals impacted are encouraged to remain vigilant against incidents of identity theft by reviewing their account statements and explanations of benefits for any unusual activity.
Initial Incident Identified
On December 9, 2024, Blue learned of an unauthorized actor who claimed to have taken data from one server in Blue’s IT environment.
Engaged Forensic Specialists
After identifying this matter, Blue quickly isolated the impacted server and launched an investigation with the assistance of third-party forensic specialists. This investigation revealed that there was unauthorized access to an endpoint through phishing on or about November 7, 2024, for less than a half hour, at which time data was removed.
Initial Review Completed
Blue then engaged third-party data review specialists to perform a detailed review of the data involved to understand the contents of that data, whether it was sensitive, and to whom it relates. This review was completed May 20, 2025. Blue was able to identify that information provided to Blue by certain companies was impacted. As of July 3, Blue began providing notice to potentially impacted individuals.
MONITOR
Monitor your credit reports for suspicious or unauthorized activity. Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. To order your free credit report, visit annualcreditreport.com or call, toll-free, 1-877-322-8228.
ALERTS
Place a fraud alert on your credit file. Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years.
FREEZE
Place a security freeze on your credit file. As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent.
Get in Touch with Us
Individuals for whom we have a valid mailing address will receive a direct notification letter if their data may have been impacted.
If you have questions or think you may be impacted, please call or email us. We will be standing up a toll-free call center and will be updating this page once this information is available.
What information was affected?
Blue’s review of the impacted files identified the following types of personal information could have been involved: name, Social Security number, driver’s license number, passport number, individual tax identification number, financial account information with or without access credential, medical information, medical record number, diagnostic information, procedure type, admission date, patient identification number, Medicare identification number, billing / claims information, patient encounter number, treatment location, treatment cost, prescription information, mental or physical condition, treating/referring physician, diagnostic code, date of birth, username/password, and health insurance information may be impacted.
How will individuals know if this incident impacts them?
Individuals for whom we have a valid mailing address will receive a direct notification letter if their data may have been impacted. If you have questions or think you may be impacted, please call or email us at support@blueandco.com. We will be standing up a toll-free call center and will be updating this page once this information is available.
What steps has Blue taken to address this?
Information privacy and security are among our highest priorities. Blue has strict security measures in place to protect information in our care. Upon learning of this event, Blue promptly took steps to confirm the scope of the incident. Notice was also provided to federal law enforcement and the U.S. Department of Health and Human Services.
What can I do as an affected individual?
Impacted individuals are encouraged to remain vigilant against incidents of identity theft by reviewing their account statements and explanation of benefits for unusual activity. Additional information can be found below in the Steps You Can Take to Help Protect Your Information and in the notification letters that were sent to impacted individuals.
© 2025 Blue & Co., LLC | Legal Notice | Privacy Policy