Metabase Zero-Day Leads to Data Breach of 58,000 Patient Records at Dorsata; Related Healthcare Breaches Affect Thousands More
Dorsata, a Virginia healthcare tech company, disclosed a data breach involving 58,249 patient records due to exploitation of a zero-day vulnerability in Metabase business intelligence software between August 10-12, 2026. The exposed data included sensitive patient health details and insurance information. The threat actor behind the breach is unknown, though the Dire Wolf group exploited the same vulnerability later in other attacks. Separately, Bay Area Psychological Consultants in Florida notified 5,679 patients after a breach at third-party provider CareCloud, involving unauthorized AWS environment access in March 2026. Lansing Urgent Care in Michigan suffered a suspected ransomware attack by INC Ransom group around September 2026, with data leak confirmed but exact impact still under review. No evidence of data misuse has been confirmed in these incidents, but affected individuals have been advised to take precautions.
Entenda a falha
A vulnerabilidade
An unnamed zero-day in Metabase business intelligence software, with no CVE assigned in the story. The articles do not give the affected component, the affected or fixed versions, or what an attacker needs (authentication, network reach, configuration). Exploitation gave an unauthorized party access to a database platform holding patient records. Dorsata says it applied a patch.
Como funciona
The articles do not describe the technical mechanism. They say only that between August 10 and 12, 2026, an unauthorized party exploited the Metabase flaw and reached a database platform with medical information from Dorsata's healthcare provider partners. The exposed data included names, addresses, patient IDs, dates of birth, vitals, treatments, medications, vaccinations, insurance details and medical histories.
Por que é vulnerável
The root cause is not disclosed in the articles. They only call it a previously unknown (zero-day) vulnerability in Metabase that was patched, and do not explain what the fix changes.
Como foi descoberta
On or around August 12, 2026, Dorsata was informed that Metabase contained a zero-day. It applied a patch and hired cybersecurity experts, whose investigation found exploitation between August 10 and 12. The articles do not say who found the flaw or how it was reported. The initial attacker is unknown. VenariX, cited by HIPAA Journal, says the Dire Wolf group appears to have exploited it in at least two later attacks. Dorsata reported the breach to the HHS Office for Civil Rights, covering 58,249 people.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a published proof of concept. The flaw was exploited in real attacks, first at Dorsata and later, reportedly, by Dire Wolf, so a working exploit exists in attackers' hands. No public copy is mentioned. Because exploitation is confirmed, Metabase instances should be patched urgently.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 10:17.
Linha do tempo
-
Metabase Zero-Day Leads to Data Breach of 58,000 Patient Records at Dorsata; Related Healthcare Breaches Affect Thousands More
ler a análise desta fonte ocultar
Dorsata, a Virginia healthcare tech company, disclosed a data breach involving 58,249 patient records due to exploitation of a zero-day vulnerability in Metabase business intelligence software between August 10-12, 2026. The exposed data included sensitive patient health details and insurance information. The threat actor behind the breach is unknown, though the Dire Wolf group exploited the same vulnerability later in other attacks. Separately, Bay Area Psychological Consultants in Florida notified 5,679 patients after a breach at third-party provider CareCloud, involving unauthorized AWS environment access in March 2026. Lansing Urgent Care in Michigan suffered a suspected ransomware attack by INC Ransom group around September 2026, with data leak confirmed but exact impact still under review. No evidence of data misuse has been confirmed in these incidents, but affected individuals have been advised to take precautions.