Sensitive data of over 40,000 people impacted in Blue Fish Pediatrics cyber attack

Texas-based Blue Fish Pediatrics said a data security incident it suffered last year compromised the sensitive personal information of more than 40,000 individuals.

 

Blue Fish Pediatrics is a Texas-based healthcare provider that delivers comprehensive medical care for infants, children, and adolescents through a network of clinics. Its services include preventive care, regular health checkups, vaccinations, and treatment for a range of childhood illnesses.

 

In a data security incident notice posted on its website, Blue Fish Pediatrics said that on July 17, it became aware of a security incident affecting its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected systems and notified relevant law enforcement authorities about the incident.

 

“After an extensive forensic investigation and manual document review, we discovered on May 4, 2026, that between July 11, 2025 and July 17, 2025, a limited number of files potentially accessed or acquired by the unauthorised party,” Blue Fish Pediatrics said.

 

The compromised data includes names, Social Security numbers, dates of birth, driver’s license and state identification numbers, medical record numbers, diagnosis/conditions information, lab results, medications information, healthcare claims information, and clinical/treatment information.

 

The incident was reported to the Office of Texas Attorney General where Blue Fish Pediatrics said it has identified at least 41,485 individuals who were impacted by the incident.

 

While the healthcare provider found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Blue Fish Pediatrics. The pediatric healthcare provider also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.