Two hackers copied data of 340,915 patients via Metabase flaw
A hacker exploited a critical vulnerability in Metabase, an analytics tool used by Blueberry Pediatrics, and obtained a copy of data on 340,915 patients. Photon, a prescription service that also used Metabase, reported that a second actor exploited the same flaw and copied a subset of the same data. Patient photos and videos were not affected, according to HIPAA Journal.
What happened
A hacker exploited a critical vulnerability in Metabase, a third-party analytics tool used by Blueberry Pediatrics, and obtained a copy of data on 340,915 patients. Photon, a prescription service used by the company, reported that a different actor exploited the same flaw and copied a subset of the same data.
Why it matters
The stolen data includes names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges. At Photon, names, addresses, phone numbers, email addresses, member IDs and/or medication information were compromised. This is sensitive health data on children served through telemedicine.
What to do
Affected patients should wait for the official notification and monitor the use of their information. Companies using Metabase or similar analytics tools should verify the vulnerability is patched and review those tools' access to customer data.
For the technical team
- Affected
- Blueberry Pediatrics (serviço de telemedicina pediátrica); dados de 340.915 pacientes copiados após exploração de falha · Blueberry Pediatrics (pediatric telemedicine service) and Photon (prescription service), both used Metabase. Metabase is used by more than 100,000 organizations. Versions not stated in the source.
- Exploitation
- Exploitation confirmed. On August 22, 2026, Blueberry Pediatrics learned a hacker had exploited the flaw and obtained a copy of patient data. On August 24, 2026, Photon advised that a second threat actor exploited the same flaw. Reported by HIPAA Journal.
- Fix
- No software to update
- Vector
- Critical vulnerability in Metabase, a business intelligence and data visualization platform used by Blueberry Pediatrics and Photon. A hacker exploited it and obtained a copy of patient data. The exploitation precondition is not detailed in the source.
- More details
- Data stolen from Blueberry Pediatrics: names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges. At Photon: names, addresses, phone numbers, email addresses, member IDs and/or medication information. Blueberry Pediatrics confirmed patient photos and videos were stored separately and were not compromised. The analysis of the impacted data was performed by Blueberry Pediatrics itself.
Timeline
First report: exploitation of a Metabase flaw stole data on 340,915 Blueberry Pediatrics patients.
