Breaches and incidents
Blueberry Pediatrics (SparkMD): Metabase zero-day used to steal data of 340,915 patients
Blueberry’s notice filed with the California AG on 10 Oct 2026 says a “previously unknown security vulnerability” in Metabase, which it uses for reporting...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Blueberry’s notice filed with the California AG on 10 Oct 2026 says a “previously unknown security vulnerability” in Metabase, which it uses for reporting and analysis, was exploited, leading to “the theft of a copy of certain patient data”; a second notice covers a subset of the same data exposed via its prescription vendor Photon’s Metabase instance. HIPAA Journal reports the Oregon AG was told 340,915 people were affected.
- Root cause: exploitation of a Metabase zero-day in Blueberry’s business intelligence environment (and separately at Photon).
- No attacker named; HIPAA Journal refers to “a hacker” and “a different threat actor” for the two incidents.
- Blueberry locked out the intruder, applied Metabase’s patch, changed passwords, contacted law enforcement and strengthened authentication.