Metabase vulnerability exploited at Blueberry Pediatrics and Photon, exposing data of 340,915 patients
Blueberry Pediatrics, a telemedicine provider, disclosed a data breach affecting 340,915 individuals after a critical vulnerability in the third-party business intelligence platform Metabase was exploited. The company learned of the exploitation on August 22, 2026. On August 24, 2026, its prescription service provider Photon, which also used Metabase, reported that a different threat actor had exploited the same flaw and copied a subset of the same patient data. Because the data was exposed in multiple incidents, some individuals may receive more than one breach notice.
Entenda a falha
A vulnerabilidade
A critical, unnamed vulnerability in Metabase, the business intelligence and data visualization platform, which the articles say is used by more than 100,000 organizations. No CVE is given. The articles do not describe the vulnerable component, what an attacker needs (authentication, network reach, configuration) or which versions are affected and fixed. What is known is the result: two separate, unnamed threat actors exploited it and copied patient data held by Blueberry Pediatrics and by its prescription provider Photon. Metabase released a patch, which Blueberry Pediatrics applied within hours of being notified.
Como funciona
The articles do not explain how the flaw works technically. They only say that a threat actor exploited the vulnerability in Metabase instances used by Blueberry Pediatrics and by Photon, and then obtained a copy of patient data stored in or reachable through them. Which input reaches which component, and at which step the software fails, is not stated.
Por que é vulnerável
The root cause is not described in the articles; they only call the flaw critical. They do not say why it went unnoticed or what the patch changes. Blueberry Pediatrics' own response points to a process gap: it is adding a monitoring and escalation process for critical vendor vulnerabilities, strengthening authentication controls and reviewing security more often. Even a patch applied within hours came after a threat actor already had access to its data.
Como foi descoberta
The articles do not say who found the flaw or how. According to them, Metabase notified Blueberry Pediatrics about the vulnerability, and the company says it patched within hours. It learned on August 22, 2026 that a hacker had already exploited it and copied patient data. On August 24, 2026, Photon told Blueberry Pediatrics that a different threat actor had also exploited the flaw and copied a subset of the same data. The breach was reported to the Oregon and Texas Attorneys General, and as of the article it was not listed on the HHS OCR portal.
Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:20.
Detalhes técnicos
- The article does not give a CVE identifier for the Metabase flaw. It describes it only as critical.
- Two separate threat actors, neither named, exploited the vulnerability and obtained copies of patient data.
- Data stolen from Blueberry Pediatrics included names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes and charges for services.
- Data exposed at Photon included names, addresses, phone numbers, email addresses, member IDs and/or medication information.
- Patient photos and videos were stored separately and were not compromised. Financial information and Social Security numbers were not involved.
- The breach was reported to the Oregon Attorney General (340,915 individuals). The Texas Attorney General received two reports, covering 60,581 and 7,249 residents. It was not yet listed on the HHS OCR breach portal.
Remediação
- Blueberry Pediatrics was notified by Metabase and applied the patch within hours, but a threat actor already had access to its data.
- Access was blocked, and passwords and security protocols were changed after patching.
- The company is strengthening authentication controls, increasing the frequency of security reviews, and adding a monitoring and escalation process for critical vendor vulnerabilities.
Linha do tempo
-
Metabase vulnerability exploited at Blueberry Pediatrics and Photon, exposing data of 340,915 patients
ler a análise desta fonte ocultar
Blueberry Pediatrics, a telemedicine provider, disclosed a data breach affecting 340,915 individuals after a critical vulnerability in the third-party business intelligence platform Metabase was exploited. The company learned of the exploitation on August 22, 2026. On August 24, 2026, its prescription service provider Photon, which also used Metabase, reported that a different threat actor had exploited the same flaw and copied a subset of the same patient data. Because the data was exposed in multiple incidents, some individuals may receive more than one breach notice.
Technical Details
- The article does not give a CVE identifier for the Metabase flaw. It describes it only as critical.
- Two separate threat actors, neither named, exploited the vulnerability and obtained copies of patient data.
- Data stolen from Blueberry Pediatrics included names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes and charges for services.
- Data exposed at Photon included names, addresses, phone numbers, email addresses, member IDs and/or medication information.
- Patient photos and videos were stored separately and were not compromised. Financial information and Social Security numbers were not involved.
- The breach was reported to the Oregon Attorney General (340,915 individuals). The Texas Attorney General received two reports, covering 60,581 and 7,249 residents. It was not yet listed on the HHS OCR breach portal.
Remediation
- Blueberry Pediatrics was notified by Metabase and applied the patch within hours, but a threat actor already had access to its data.
- Access was blocked, and passwords and security protocols were changed after patching.
- The company is strengthening authentication controls, increasing the frequency of security reviews, and adding a monitoring and escalation process for critical vendor vulnerabilities.