A pediatric telemedicine provider has told 340,915 people that an intruder reached patient records via a self-hosted analytics tool, and that a second attacker later took a copy of similar data from the company that handles its prescriptions.
Blueberry Pediatrics, which gives subscribers access to board-certified pediatricians, learned on August 22, 2026 that a critical Metabase flaw had been exploited. More than 100,000 organizations use that business intelligence and visualization software, plenty of them small health technology teams running it inside their own networks.
Two attackers, one stolen data set
Photon, the prescription service Blueberry depends on, said on August 24, 2026 that a different threat actor had worked the same flaw and also obtained patient records. Blueberry’s theft covered billing details like plan names and policy numbers, charges for services, medical codes, service dates, birth dates and patient names. Photon lost contact data and medication information, including postal and email addresses, phone numbers and member IDs.
Patient photos and videos sat in a separate system and came through untouched, as did financial data and Social Security numbers. Some families should expect a second notice, since the same records surfaced twice. Oregon’s attorney general was told all 340,915 were affected, while Texas received two reports, covering 60,581 and 7,249 residents. The federal portal still does not list it.
The patch arrived after the data left
Blueberry patched within hours of Metabase’s alert, blocked the access, then changed passwords and security protocols. It has since toughened login checks, scheduled security reviews more often, and added monitoring plus an escalation route for critical vendor flaws.
None of it recovered the records. Any healthcare organization running self-hosted dashboards should assume the software is reachable unless proven otherwise, check vendor advisories against its own installs, and map which sit near clinical databases.
