Dorsata confirms Metabase zero-day exposed 58,249 patients' data

Dorsata says an investigation found that an unauthorized third party exploited a previously unknown Metabase vulnerability from August 10 to August 12, 2026, reaching a database with medical information tied to 58,249 people. The company reportedly patched the flaw after learning about it on August 12.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list

According to HIPAA Journal, Dorsata was told on or around August 12 that Metabase contained a zero-day, meaning a vulnerability that had not previously been known. Dorsata applied a patch and hired cybersecurity specialists, whose subsequent investigation reportedly identified exploitation during the preceding two days.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list

The reported exposure goes well beyond contact details. Names and addresses were stored alongside medical histories, medications, treatment and vaccination information, insurance data and other health records. That combination could make resulting fraud or impersonation attempts more convincing, although the supplied evidence does not show that such abuse occurred.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list

Organizations running Metabase should verify that the relevant fix was applied and review access records for activity before August 12 rather than treating patching alone as proof that their systems were untouched. Potentially affected patients should monitor insurance statements, medical records and financial accounts for unfamiliar activity.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list[2]Metabase Zero-Day and Ransomware Hit Three Healthcare Providersreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The reported access window, affected population and categories of exposed information are described, but the evidence does not identify the intruder or explain the technical mechanics of the flaw. A Reddit summary says no misuse of Dorsata data had been found, but the supplied material contains no direct Dorsata notice or investigative report with which to verify that statement.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list[2]Metabase Zero-Day and Ransomware Hit Three Healthcare Providersreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

HIPAA Journal reports that Dorsata disclosed the incident to the US Department of Health and Human Services Office for Civil Rights. A subsequent r/pwnhub post repeated the account and asserted that the specific group behind the exploitation remained unidentified.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list[2]Metabase Zero-Day and Ransomware Hit Three Healthcare Providersreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The sequence reported so far is concise: exploitation allegedly began on August 10, Dorsata learned of the previously unknown vulnerability and patched it around August 12, and a later investigation concluded that the database had already been accessed during that interval.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list

2 independent groups, 2 updates, and 0 engagements. Observed communities: r/pwnhub.

Metabase is described as business-intelligence software used by Dorsata. The flaw allegedly allowed an unauthorized party to reach a database platform containing medical information, but the evidence supplies no CVE identifier, affected version, exploit method or indicators that defenders could use to hunt for the activity.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list

The strongest item in the supplied batch is an HIPAA Journal report describing Dorsata's disclosure and investigation. The Reddit post largely summarizes that report and is not independent confirmation, while the AutoModerator comment contains promotional community information and no evidence about the incident.[1]Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patientshipaajournal.com · rssOpen original sourceSee in source list[2]Metabase Zero-Day and Ransomware Hit Three Healthcare Providersreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[3]AutoModeratorreddit.com · AutoModerator · r/pwnhub · redditOpen original sourceSee in source list